RUSTSEC-2023-0082: 
Rust vulnerability analysis and mitigation

A high-severity vulnerability (RUSTSEC-2023-0082/CVE-2023-42444) was discovered in the rust-phonenumber package affecting versions <0.3.3. The vulnerability was disclosed on September 19, 2023, and involves a potential panic condition when parsing specially crafted RFC3966 phonenumber inputs (GitHub Advisory).

The vulnerability stems from a panic-guarded out-of-bounds access on the phonenumber string parsing code. The issue is specifically triggered when processing the string pattern '.;phone-context='. The vulnerability has been assigned a CVSS score of 8.6 (High), with attack vector being Network, low attack complexity, requiring no privileges or user interaction, and affecting scope with high availability impact (GitHub Advisory).

The primary impact of this vulnerability is on system availability. When successfully exploited, it can cause the application to panic, potentially leading to service disruption. The vulnerability has no direct impact on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability has been patched in versions 0.3.3+8.13.9 and backported to 0.2.5+8.11.3. Users are advised to upgrade to these patched versions as no alternative workarounds are available (GitHub Advisory).