PT-2021-24287 · Rusqlite · Rusqlite

Published 2021-12-07 · Updated 2022-06-17 · CVE-2021-45713

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: rusqlite versions 0.25.0 through 0.25.3 rusqlite versions 0.26.0 through 0.26.1

Description: The issue is related to several closure-accepting rusqlite functions having too relaxed lifetime bounds, which could allow Rust code to access objects on the stack after they have been dropped. The impacted functions include create scalar function, create aggregate function, create window function, commit hook, rollback hook, update hook, and create collation.

Recommendations: For rusqlite versions 0.25.0 through 0.25.3, upgrade to version 0.25.4 or newer. For rusqlite versions 0.26.0 through 0.26.1, upgrade to version 0.26.2 or newer. As a temporary workaround, consider disabling the use of the impacted functions until a patch is available. Restrict access to the vulnerable functions to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-45713

GHSA-4QR3-M7WW-HH9G

GHSA-87XH-9Q6H-R5CC

GHSA-92CX-4XM7-JR9M

GHSA-CM8G-544F-P9X9

GHSA-F6F2-3W33-54R9

GHSA-G4G4-3PQW-8M7F

GHSA-G87R-23VW-7F87

GHSA-Q89G-4VHH-MVVM

RUSTSEC-2021-0128

Affected Products

Rusqlite

References · 28

• 🔥 https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/rusqlite/RUSTSEC-2021-0128.md · Exploit
• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0128.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45717 · Security Note
• https://osv.dev/vulnerability/GHSA-f6f2-3w33-54r9 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0128 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q89g-4vhh-mvvm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g87r-23vw-7f87 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45715 · Security Note
• https://osv.dev/vulnerability/GHSA-cm8g-544f-p9x9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45714 · Security Note
• https://osv.dev/vulnerability/GHSA-87xh-9q6h-r5cc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45713 · Security Note
• https://osv.dev/vulnerability/GHSA-92cx-4xm7-jr9m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45719 · Security Note