Reported

September 24, 2020

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

stack (crates.io)

Type

Vulnerability

Aliases

• CVE-2020-35895
• GHSA-h45v-vgvp-3h5v

References

• https://github.com/arcnmx/stack-rs/issues/4

CVSS Score

9.8 CRITICAL

CVSS Details

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patched

• >=0.3.1

Description

ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds.

Advisory available under CC0-1.0 license.