CVE-2021-43620

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan pada fruity project fruity. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string.

Rincian

Terbit di NVD

15 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nvzqz/fruity/issues/14 exploit · issue tracking · patch · advisory pihak ketiga
• https://github.com/rustsec/advisory-db/pull/1102 exploit · patch · advisory pihak ketiga
• https://rustsec.org/advisories/RUSTSEC-2021-0123.html exploit · advisory pihak ketiga