CVE-2020-36323

Katalog CVE

CVSS 8.2 · High EPSS 2,0%

Kerentanan Use of Externally-Controlled Format String pada rust-lang rust, fedoraproject fedora. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

Rincian

Terbit di NVD

14 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rust-lang/rust/issues/80335 patch · advisory pihak ketiga
• https://github.com/rust-lang/rust/pull/81728 patch · advisory pihak ketiga
• https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174 patch · advisory pihak ketiga
• https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190 patch · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZ337CM4GFJLR...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFUO3URYCO73D...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZG65GUW6Z2CY...