CVE-2020-35909: High severity protocol Multihash Rust vulnerability
Published Dec 31, 2020
·Updated
An issue was discovered in the multihash crate before 0.11.3 for Rust. The fromslice parsing code can panic via unsanitized data from a network server.
Affected Software
1 affected component
protocol Multihash Rust<0.11.3
Remediation
Patch Available
Event History
Dec 31, 2020
CVE Published
via MITRE·08:20 AM
Data Sourced
via MITRE·08:20 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-35909?
The severity of CVE-2020-35909 is considered to be medium due to potential Denial of Service through a panic in the application.
2
How do I fix CVE-2020-35909?
To fix CVE-2020-35909, upgrade the multihash crate to version 0.11.3 or later.
3
What is the impact of CVE-2020-35909?
CVE-2020-35909 can cause a panic in applications using unsanitized data received from a network server.
4
Which versions of the multihash crate are affected by CVE-2020-35909?
CVE-2020-35909 affects all versions of the multihash crate before 0.11.3.
5
Is CVE-2020-35909 exploitable in production environments?
Yes, CVE-2020-35909 can be exploited in production environments if the application processes unsanitized input from an untrusted network source.