CVE-2020-36323

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

References

Affected packages

Git / github.com/rust-lang/rust

Affected ranges

Type

GIT

Repo

https://github.com/rust-lang/rust

Events

Introduced

Fixed

88f19c6dab716c6281af7602e30f413e809c5974

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.52.0"
        }
    ]
}

Affected versions

0.*

0.1

0.10

0.11.0

0.12.0

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.*

1.0.0

1.0.0-alpha

1.0.0-alpha.2

1.0.0-beta

1.1.0

1.10.0

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.15.0

1.15.1

1.16.0

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.23.0

1.24.0

1.24.1

1.25.0

1.26.0

1.26.1

1.26.2

1.27.0

1.27.1

1.27.2

1.28.0

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.31.0

1.31.1

1.32.0

1.33.0

1.34.0

1.34.1

1.34.2

1.35.0

1.36.0

1.37.0

1.38.0

1.39.0

1.4.0

1.40.0

1.41.0

1.41.1

1.42.0

1.43.0

1.43.1

1.44.0

1.44.1

1.45.0

1.45.1

1.45.2

1.46.0

1.47.0

1.48.0

1.49.0

1.5.0

1.50.0

1.51.0

1.53.0

1.54.0

1.55.0

1.56.0

1.56.1

1.57.0

1.58.0

1.58.1

1.59.0

1.6.0

1.60.0

1.61.0

1.62.0

1.62.1

1.63.0

1.64.0

1.65.0

1.66.0

1.66.1

1.67.0

1.67.1

1.68.0

1.68.1

1.68.2

1.69.0

1.7.0

1.70.0

1.71.0

1.71.1

1.72.0

1.72.1

1.73.0

1.74.0

1.74.1

1.75.0

1.76.0

1.77.0

1.77.1

1.77.2

1.78.0

1.79.0

1.8.0

1.80.0

1.80.1

1.81.0

1.82.0

1.83.0

1.84.0

1.84.1

1.85.0

1.85.1

1.86.0

1.87.0

1.88.0

1.89.0

1.9.0

1.90.0

1.91.0

1.91.1

1.92.0

1.93.0

1.93.1

1.94.0

1.94.1

release-0.*

release-0.1

release-0.2

release-0.3

release-0.3.1

release-0.4

release-0.5

release-0.6

release-0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36323.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    }
]