First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2020-35871

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/rusqlite/rusqlite/releases/tag/0.23.0Release Notes, Third Party Advisory
https://rustsec.org/advisories/RUSTSEC-2020-0014.htmlThird Party Advisory
https://github.com/rusqlite/rusqlite/releases/tag/0.23.0Release Notes, Third Party Advisory
https://rustsec.org/advisories/RUSTSEC-2020-0014.htmlThird Party Advisory

Timeline

Published: Dec 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-358729.8An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.CVE-2020-358739.8An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free CVE-2020-358748.1An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-fr CVE-2020-358757.5An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly.CVE-2020-358769.8An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive informa CVE-2020-358779.8An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access.CVE-2020-358789.8An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized m CVE-2020-358799.8An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw CVE-2020-35887.8A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute CVE-2020-358809.8An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation.CVE-2020-358819.8An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing CVE-2020-358828.1An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same