1. Home
  2. CVE Database
  3. CVE-2020-36323
HIGH · 8.2

CVE-2020-36323

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes af...

Vulnerability Description

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.

CVSS Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
Rust-LangRust< 1.52.0
FedoraprojectFedora32

Related Weaknesses (CWE)

CWE-134

References

FAQ

What is CVE-2020-36323?

CVE-2020-36323 is a vulnerability with a CVSS score of 8.2 (HIGH). In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes af...

How severe is CVE-2020-36323?

CVE-2020-36323 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-36323?

Check the references section above for vendor advisories and patch information. Affected products include: Rust-Lang Rust, Fedoraproject Fedora.