PT-2020-17510 · Rust · Ozone Crate

Published 2020-07-04 · Updated 2021-08-25 · CVE-2020-35878

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ozone crate versions through 0.1.0

Description An issue was discovered in the ozone crate for Rust, where memory safety is violated. This is due to the dropping of uninitialized memory and out-of-bounds access.

Recommendations For versions through 0.1.0, update to a version that contains a fix for this issue to prevent memory safety violations.

Fix

Buffer Overflow

Use of Uninitialized Resource

Weakness Enumeration

CWE-119

CWE-908

Related Identifiers

CVE-2020-35878

GHSA-M3WW-7HRP-GW9W

GHSA-P2Q9-9CQ6-H3JW

RUSTSEC-2020-0022

Affected Products

Ozone Crate

References · 10

• https://osv.dev/vulnerability/RUSTSEC-2020-0022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2q9-9cq6-h3jw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35878 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35877 · Security Note
• https://osv.dev/vulnerability/GHSA-m3ww-7hrp-gw9w · Vendor Advisory
• https://github.com/bqv/ozone · Note
• https://crates.io/crates/ozone · Note
• https://rustsec.org/advisories/RUSTSEC-2020-0022.html · Note
• https://t.me/cvenotify/8265 · Telegram Post