Home > Vulnerability Database > CVE-2020-35861

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-35861

Good to know:

Date: December 31, 2020

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

Language: RUST

Severity Score

7.5

Related Resources (6)

Url: https://github.com/fitzgen/bumpalo

Url: https://github.com/fitzgen/bumpalo/issues/69

Url: https://rustsec.org/advisories/RUSTSEC-2020-0006.html

Url: https://crates.io/crates/bumpalo

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-35861

Url: https://www.mend.io/vulnerability-database/CVE-2020-35861

Severity Score

7.5

Weakness Type (CWE)

Out-of-bounds Read

CWE-125

Top Fix

Upgrade Version

Upgrade to version bumpalo - 3.2.1

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us