RUSTSEC-2024-0369: 
Rust vulnerability analysis and mitigation

A high severity vulnerability (RUSTSEC-2024-0369) was discovered in the rust-phonenumber package affecting versions >= 0.3.4 and < 0.3.6. The vulnerability was disclosed on July 9, 2024, and involves a potential panic in the phonenumber parsing code when processing specially crafted inputs (GitHub Advisory).

The vulnerability stems from a reachable assert! guard on the phonenumber string processing. The issue specifically occurs when parsing strings formatted as '+dwPAA;phone-context=AA', where the 'number' part potentially parses as a number larger than 2^56. The vulnerability has been assigned a CVSS score of 8.6 (High), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and affecting system availability (GitHub Advisory).

The primary impact of this vulnerability is on system availability. When successfully exploited, it can cause the application to panic, potentially leading to denial of service. The vulnerability has no direct impact on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability can be exploited remotely by sending maliciously crafted phone numbers over the network. The attack complexity is considered low, requiring no special privileges or user interaction. A proof-of-concept exploit exists using the string pattern '+dwPAA;phone-context=AA' (GitHub Advisory).

The vulnerability has been patched in version 0.3.6 and later releases. Users are advised to upgrade to version 0.3.6 or higher. No alternative workarounds are available (GitHub Advisory).