CVE-2020-35870: 
Rust vulnerability analysis and mitigation

A critical memory safety vulnerability was discovered in the rusqlite crate (versions before 0.23.0) for Rust, identified as CVE-2020-35870. The vulnerability was disclosed on December 31, 2020, and involves a use-after-free issue in the Auxdata API implementation. This vulnerability affects the core functionality of the rusqlite database library (NVD, RustSec).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically relates to memory safety violations that can occur through improper handling of the Auxdata API, resulting in a use-after-free condition. This vulnerability is classified as CWE-416 (Use After Free) (NVD).

The vulnerability can lead to memory corruption, potentially allowing attackers to execute arbitrary code, cause program crashes, or access sensitive information. Given the CVSS score of 9.8, this vulnerability represents a critical risk to applications using affected versions of the rusqlite crate (NVD).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is rated as low, indicating that exploitation is straightforward once the vulnerability is understood (NVD).

The vulnerability has been fixed in rusqlite version 0.23.0. Users should upgrade to this version or later to address the security issue. The fix includes changes to the Auxdata API implementation with new bounds to prevent use-after-free conditions (Github Release).