CVE-2020-35858

An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service e.g., x86 or possibly remote code execution e.g., ARM...

actix-protobuf (>=0.4.0, <=0.4.1), arc-cli (0.1.0) +106 more potentially affected by CVE-2020-35858 via prost (>=0.1.0, <=0.5.0)

prost CARGO version =0.1.0, =0.4.0, =0.8.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0-alpha, =0.1.0, =0.1.0, =0.8.0, =0.1.0-alpha.1, =0.1.0-alpha.2 and more Source cves: CVE-2020-35858 Source advisory: OSV:GHSA-GV73-9MWV-FWGQ...

CVE-2020-35858

The CVE-2020-35858 issue affects the prost crate for Rust prior to 0.6.1, where decoding a crafted message can cause stack consumption leading to denial of service (notably on x86) and potentially remote code execution (e.g., on ARM). The root cause is a stack-related flaw in parsing untrusted in...

actix-protobuf (>=0.4.0, <=0.4.1), arc-cli (0.1.0) +106 more potentially affected by CVE-2020-35858 via prost (>=0.1.0, <=0.5.0)

prost CARGO version =0.1.0, =0.4.0, =0.8.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0-alpha, =0.1.0, =0.1.0, =0.8.0, =0.1.0-alpha.1, =0.1.0-alpha.2 and more Source cves: CVE-2020-35858 Source advisory: OSV:RUSTSEC-2020-0002...