CRITICAL9.8

GHSA-j8q9-5rp9-4mv9

Fix a use-after-free bug in diesels Sqlite backend

Details

An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name are not followed.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/diesel

Introduced in: 0Fixed in: 1.4.6

Upgrade diesel to 1.4.6 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2021-28305[ADVISORY]
https://github.com/diesel-rs/diesel/pull/2663[WEB]
https://github.com/diesel-rs/diesel[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0037.html[WEB]