CVE-2020-35909: 
Rust vulnerability analysis and mitigation

An issue was discovered in the multihash crate before version 0.11.3 for Rust, identified as CVE-2020-35909. The vulnerability was reported on November 8, 2020, and officially issued on November 9, 2020. The vulnerability affects the from_slice parsing code functionality, which can panic when processing unsanitized data received from a network server (RustSec Advisory).

The vulnerability exists in the multihash::digests::MultihashGeneric::from_bytes and multihash::digests::MultihashRefGeneric::from_slice functions for versions prior to 0.11.3. The issue stems from undocumented panic behavior in the from_slice function, despite its return type (Result) suggesting otherwise. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network vector access with low attack complexity and no required privileges or user interaction (RustSec Advisory).

The vulnerability can lead to a Denial of Service (DoS) condition when processing malformed input from untrusted sources. This is particularly concerning as the from_slice/from_bytes functions are frequently used in networking code, such as in rust-libp2p, where they process unsanitized data from untrusted sources. Attackers can exploit this to cause unexpected panics in network client code, potentially disrupting service availability (RustSec Advisory).

The vulnerability is exploitable remotely through network access, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit in environments where the affected code processes untrusted network input (RustSec Advisory).

The vulnerability has been fixed in version 0.11.3 of the multihash crate. Users should upgrade to this version or later to address the vulnerability (RustSec Advisory).