codehearts / codehearts/remembear
RUSTSEC-2022-0090: `libsqlite3-sys` via C SQLite CVE-2022-35737
- Dominant language
- Rust
- Stars
- 3
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
> `libsqlite3-sys` via C SQLite CVE-2022-35737
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `libsqlite3-sys` |
| Version | `0.22.2` |
| URL | [https://nvd.nist.gov/vuln/detail/CVE-2022-35737](https://nvd.nist.gov/vuln/detail/CVE-2022-35737) |
| Date | 2022-08-03 |
| Patched versions | `>=0.25.1` |
It was sometimes possible for SQLite versions >= 1.0.12, < 3.39.2 to allow an array-bounds overflow when large string were input into SQLite's `printf` function.
As `libsqlite3-sys` bundles SQLite, it is susceptible to the vulnerability. `libsqlite3-sys` was updated to bundle the patched version of SQLite [here](https://github.com/rusqlite/rusqlite/releases/tag/sys0.25.1).
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2022-0090.html) for additional details.
Contributor guide
Assessment
This issue has not been assessed yet.