p PatchFirst

CVE-2020-36323

CVE-2020-36323

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

CVSS 8.2 · High · EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • rustc Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1-1

    Update to 1.53.0+dfsg1-1

  • rustc Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1-1

    Update to 1.53.0+dfsg1-1

  • rustc Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1-1

    Update to 1.53.0+dfsg1-1

  • rustc Ubuntu:Pro:14.04:LTS

    Versions
    • 1.15.1+dfsg0-1~exp1ubuntu2~14.04.7
    • 1.17.0+dfsg2-8~ubuntu0.14.04.3
    • 1.21.0+dfsg1+llvm-0ubuntu3~14.04.5
    • 1.22.1+dfsg1+llvm-0ubuntu2~14.04.2
    • 1.24.1+dfsg1+llvm-0ubuntu1~14.04.1
    • 1.25.0+dfsg1+llvm-0ubuntu1~14.04.1
    • 1.28.0+dfsg1+llvm-0ubuntu1~14.04.1
    • 1.30.0+dfsg1+llvm-2ubuntu1~14.04.1
    • 1.31.0+dfsg1+llvm-2ubuntu1~14.04.1
    • 1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rustc Ubuntu:Pro:16.04:LTS

    Versions
    • 1.7.0+dfsg1-1
    • 1.15.1+dfsg0-1~exp1ubuntu2~16.04.3
    • 1.17.0+dfsg2-8~ubuntu0.16.04.2
    • 1.21.0+dfsg1+llvm-0ubuntu3~16.04.1
    • 1.22.1+dfsg1+llvm-0ubuntu2~16.04.2
    • 1.24.1+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.25.0+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.28.0+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.30.0+dfsg1+llvm-2ubuntu1~16.04.1
    • 1.31.0+dfsg1+llvm-2ubuntu1~16.04.1
    • 1.32.0+dfsg1+llvm-1ubuntu1~16.04.1
    • 1.34.1+dfsg2+llvm-0ubuntu1~16.04.1
    • 1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1
    • 1.36.0+dfsg1+llvm-2ubuntu1~16.04.1
    • 1.37.0+dfsg1+llvm-1ubuntu1~16.04.1
    • 1.39.0+dfsg1+llvm-3ubuntu1~16.04.1
    • 1.41.0+dfsg1+llvm-0ubuntu1~16.04.1
    • 1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1
    • 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1
    • 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rustc Ubuntu:20.04:LTS

    Versions
    • 1.37.0+dfsg1+llvm-1ubuntu1
    • 1.38.0+dfsg0.2+llvm-0ubuntu1
    • 1.38.0+dfsg0.2+llvm-0ubuntu2
    • 1.39.0+dfsg1+llvm-3ubuntu1
    • 1.40.0+dfsg1+llvm-5ubuntu1
    • 1.41.0+dfsg1+llvm-0ubuntu1
    • 1.41.0+dfsg1+llvm-0ubuntu2
    • 1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1
    • 1.47.0+dfsg1+llvm-1ubuntu1~20.04.1
    • 1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2
    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1

    Update to 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1

  • rustc Ubuntu:22.04:LTS

    Versions
    • 1.51.0+dfsg1+llvm-1~exp3ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.53.0+dfsg1+llvm-4ubuntu1

    Update to 1.53.0+dfsg1+llvm-4ubuntu1

Original sources

Check your server →