RUSTSEC-2022-0031: 
Rust vulnerability analysis and mitigation

RUSTSEC-2022-0031 is a vulnerability in the rulex crate that affects versions 0.4.2 and earlier. The vulnerability was discovered and disclosed in June 2022, impacting the Rust programming language ecosystem. The issue affects applications that parse untrusted rulex expressions (GitHub Advisory).

The vulnerability occurs when parsing untrusted rulex expressions containing multi-byte UTF-8 code points in string literals or after backslashes. The issue arises because rulex attempts to slice into the code point, resulting in a panic. This is tracked as CVE-2022-31100 and is categorized as CWE-617 (Reachable Assertion). The severity is rated as Low (GitHub Advisory).

When exploited, this vulnerability can lead to application crashes, potentially enabling Denial of Service (DoS) attacks. This is particularly concerning for services that parse untrusted rulex expressions, as the service becomes unavailable when the thread running rulex panics (GitHub Advisory).

The vulnerability has been patched in version 0.4.3 of the rulex crate. Users are advised to update to this version. As a workaround, developers can use catch_unwind to recover from panics if updating is not immediately possible (GitHub Advisory).