Reported

November 28, 2020

Issued

November 28, 2020 (last modified: June 13, 2023)

Package

pyo3 (crates.io)

Type

Vulnerability

Keywords

#memory-corruption

Aliases

• CVE-2020-35917
• GHSA-2vx6-fcw6-hpr6

References

• https://github.com/PyO3/pyo3/pull/1297

CVSS Score

5.5 MEDIUM

CVSS Details

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality Impact

None

Integrity Impact

None

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Patched

• >=0.12.4

Unaffected

• <0.12.0

Description

A bug in From<Py<T>> would lead to an extra reference count decrement, often leading to use-after-free issues.

Advisory available under CC0-1.0 license.