CVE-2020-35917: 
Rust vulnerability analysis and mitigation

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. The vulnerability (CVE-2020-35917) involves a reference-counting error and use-after-free in From<Py<T>> implementation. The issue was reported and issued on November 28, 2020, affecting versions from 0.12.0 to versions prior to 0.12.4 (RUSTSEC Advisory).

The vulnerability stems from a bug in the From<Py<T>> implementation that causes an extra reference count decrement. This incorrect reference counting behavior frequently results in use-after-free issues, which is a serious memory corruption vulnerability. The issue has been assigned a CVSS v3.1 score of 5.5 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (RUSTSEC Advisory).

The vulnerability can lead to use-after-free issues, which could result in program crashes or potential memory corruption. The CVSS scoring indicates high impact on availability while confidentiality and integrity remain unaffected (RUSTSEC Advisory).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is needed for exploitation, as indicated by the CVSS metrics (RUSTSEC Advisory).

The vulnerability has been fixed in version 0.12.4 of the pyo3 crate. Users are advised to upgrade to version 0.12.4 or later. Versions before 0.12.0 are unaffected by this vulnerability (RUSTSEC Advisory).