RUSTSEC-2023-0035: 
Rust vulnerability analysis and mitigation

RUSTSEC-2023-0035 affects the enumflags2 Rust crate, specifically related to a soundness issue in the makebitflags! macro. The vulnerability was introduced in version 0.7.0 and affects all versions up to 0.7.7. The issue allows adversarial use of the makebitflags! macro to cause undefined behavior (GitHub Release).

The vulnerability exists in the make_bitflags! macro implementation where it incorrectly accepts code that can create invalid bit patterns. For example, when using a constant value outside the defined enum variants within the macro, it could generate values of the enum with bit patterns that don't correspond to any valid variants, leading to undefined behavior when iterating over these values (GitHub Release).

When exploited, this vulnerability can lead to undefined behavior in Rust programs using the affected versions of enumflags2. The impact is particularly concerning as it breaks Rust's safety guarantees by allowing the creation of invalid enum values (GitHub Release).

The issue has been fixed in version 0.7.7 of the enumflags2 crate. All affected versions (0.7.0 through 0.7.6) have been yanked from the registry. Users should upgrade to version 0.7.7 or later to receive the fix (GitHub Release).