MEDIUM

GHSA-xpp3-xrff-w6rh

rocksdb vulnerable to out-of-bounds read

Details

Affected versions of this crate called the RocksDB C API `rocksdb_open_column_families_with_ttl()` with a pointer to a single integer TTL value, but one TTL value for each column family is expected.

This is only relevant when using `rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl()` with multiple column families.

This bug has been fixed in v0.19.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/rocksdb

Introduced in: 0Fixed in: 0.19.0

Upgrade rocksdb to 0.19.0 or newer (ecosystem crates.io).

References

https://github.com/rust-rocksdb/rust-rocksdb/pull/616[WEB]
https://github.com/rust-rocksdb/rust-rocksdb[PACKAGE]
https://github.com/rust-rocksdb/rust-rocksdb/releases/tag/v0.19.0[WEB]
https://rustsec.org/advisories/RUSTSEC-2022-0046.html[WEB]