RUSTSEC-2020-0074: 
Rust vulnerability analysis and mitigation

A reference counting error and use-after-free vulnerability was discovered in the pyo3 crate versions before 0.12.4 for Rust. The vulnerability was identified with identifier RUSTSEC-2020-0074 (CVE-2020-35917) and affected the From<Py<T>> implementation for PyObject (NVD).

The vulnerability stemmed from an incorrect implementation where destructuring of a Py object led to unexpected behavior. The issue occurred because a pointer (ptr) implemented Copy, causing it to be copied from the original object before the object was dropped, resulting in an incorrect decrease in the reference count. This created a potential use-after-free condition in the From<Py<T>> implementation (PyO3 PR). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to use-after-free conditions, potentially causing application crashes or memory corruption. The issue affects the stability and security of applications using the affected versions of the pyo3 crate (NVD).

The vulnerability requires local access and low privileges to exploit. It affects applications using pyo3 crate versions prior to 0.12.4 (NVD).

Users should upgrade to pyo3 version 0.12.4 or later, which contains the fix for this vulnerability. The fix was implemented by correcting the reference counting behavior in the From<Py<T>> implementation (PyO3 PR).