CVE-2020-36323

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

Link	Resource
https://github.com/rust-lang/rust/issues/80335	Patch Third Party Advisory
https://github.com/rust-lang/rust/pull/81728	Patch Third Party Advisory
https://github.com/rust-lang/rust/pull/81728#issuecomment-821549174	Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ337CM4GFJLRDFVQCGC7J25V65JXOG5/	Mailing List Third Party Advisory
https://github.com/rust-lang/rust/pull/81728#issuecomment-824904190	Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFUO3URYCO73D2Q4WYJBWAMJWGGVXQO4/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZG65GUW6Z2CYOQHF7T3TB5CZKIX6ZJE/	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

---

Published : 2021-04-14 07:15

Updated : 2021-04-27 02:37

---

NVD link : CVE-2020-36323

Mitre link : CVE-2020-36323

No products.

CWE-134

Use of Externally-Controlled Format String