PT-2021-12006 · Rust+6 · Rust+6

Qwaz · Published 2021-04-14 · Updated 2022-04-28 · CVE-2020-36323

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Rust versions prior to 1.52.0

Description: The issue is related to an optimization in the standard library for joining strings. This optimization can cause uninitialized bytes to be exposed or the program to crash if the borrowed string changes after its length is checked.

Recommendations: For versions prior to 1.52.0, update to version 1.52.0 or later to resolve the issue.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

ALT-PU-2021-1761

ALT-PU-2021-1775

ALT-PU-2021-3365

ALT-PU-2022-1778

CESA-2021_3063

CVE-2020-36323

MGASA-2021-0251

OESA-2021-1214

RHSA-2021:3042

RHSA-2021:3063

RHSA-2021_3063

RLSA-2021:3063

Affected Products

Alt Linux

Astra Linux

Centos

Debian

Red Hat

Rocky Linux

Rust

References · 46

• https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174 · Patch
• https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190 · Patch
• https://github.com/rust-lang/rust/pull/81728 · Patch
• https://github.com/rust-lang/rust/issues/80335 · Patch
• https://ubuntu.com/security/CVE-2020-36323 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-3063.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36323 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28876 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36318 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:3063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28877 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36323 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-36323 · Vendor Advisory