CVE-2021-28305: 
Rust vulnerability analysis and mitigation

An issue was discovered in the diesel crate before version 1.4.6 for Rust, identified as CVE-2021-28305. The vulnerability involves a use-after-free bug in the SQLite backend due to improper implementation of sqlite3_column_name semantics. The issue was reported on March 5, 2021, and received a CVSS v3.1 base score of 9.8 (CRITICAL) (RUSTSEC Advisory, NVD).

The vulnerability stems from misuse of the sqlite3_column_name function in the SQLite backend. According to SQLite documentation, the string pointer returned by sqlite3_column_name remains valid only until either the prepared statement is destroyed by sqlite3_finalize(), the statement is automatically reprepared by sqlite3_step(), or until the next call to sqlite3_column_name() on the same column. The diesel implementation incorrectly stored field names as string slices for later use after calling sqlite3_step(), which invalidated the pointer and the stored string slice (RUSTSEC Advisory).

The vulnerability received a Critical severity rating with a CVSS v3.1 base score of 9.8, indicating high potential impact across confidentiality, integrity, and availability. The vulnerability requires no privileges or user interaction and can be exploited over the network (NVD).

The vulnerability is exploitable remotely with low attack complexity and requires no privileges or user interaction. The attack vector is network-based, making it particularly concerning for applications using the affected diesel crate versions (RUSTSEC Advisory).

The vulnerability has been patched in diesel version 1.4.6 and later. Users are strongly advised to upgrade to version 1.4.6 or newer to address this security issue (RUSTSEC Advisory).