CVE-2020-35866: 
Rust vulnerability analysis and mitigation

An issue was discovered in the rusqlite crate before version 0.23.0 for Rust, identified as CVE-2020-35866. The vulnerability relates to memory safety violations that can occur through VTab / VTabCursor implementations. This security flaw was discovered during an audit of the unsafe code in the crate and was disclosed on December 31, 2020 (MITRE CVE, NVD).

The vulnerability received a CVSS v3.1 score of 9.8 (CRITICAL) and a CVSS v2.0 score of 7.5 (HIGH). The core issue stems from the unsoundness of the VTab / VTabCursor trait implementations, which could lead to memory safety violations if implemented incorrectly. The vulnerability was addressed by making VTab / VTabCursor unsafe traits, as implementing them on the wrong type was fundamentally unsound (GitHub Release).

The vulnerability could lead to memory safety violations in applications using the affected versions of the rusqlite crate. This issue primarily impacts APIs exposed through features, meaning that applications using rusqlite under default features were not affected (RustSec Advisory).

The vulnerability requires the implementation of VTab / VTabCursor traits in an application using the rusqlite crate. The issue was discovered during a security audit, and there are no public reports of this vulnerability being exploited in the wild (GitHub Release).

The vulnerability was fixed in rusqlite version 0.23.0. Users should upgrade to this version or later to address the security issue. The fix involved making VTab / VTabCursor unsafe traits, with plans for a safe VTab API in the future (GitHub Release).