RUSTSEC-2021-0035: 
Rust vulnerability analysis and mitigation

An issue was discovered in the quinn crate before version 0.7.0 for Rust, identified as RUSTSEC-2021-0035. The vulnerability was related to invalid memory access that could occur with certain versions of the standard library due to direct casting of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures (NVD).

The vulnerability stems from an incorrect assumption about the memory layout of std::net::SocketAddrV4 and std::net::SocketAddrV6 structures. The quinn crate directly cast these structures, assuming they matched the libc sockaddr_in layout, which was never guaranteed by the Rust standard library. The issue has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could lead to invalid memory access when using certain versions of the Rust standard library, potentially exposing sensitive information through memory access violations (NVD).

The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U), with potential for high confidentiality impact (C:H) but no impact on integrity (I:N) or availability (A:N) (NVD).

Users should upgrade to quinn crate version 0.7.0 or later, which contains the fix for this vulnerability (NVD).