GHSA-xpp3-xrff-w6rh: rocksdb vulnerable to out-of-bounds read

August 12, 2022

Affected versions of this crate called the RocksDB C API rocksdb_open_column_families_with_ttl() with a pointer to a single integer TTL value, but one TTL value for each column family is expected.

This is only relevant when using rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl() with multiple column families.

This bug has been fixed in v0.19.0.

References

github.com/advisories/GHSA-xpp3-xrff-w6rh
github.com/rust-rocksdb/rust-rocksdb
github.com/rust-rocksdb/rust-rocksdb/pull/616
github.com/rust-rocksdb/rust-rocksdb/releases/tag/v0.19.0
rustsec.org/advisories/RUSTSEC-2022-0046.html

Detect and mitigate GHSA-xpp3-xrff-w6rh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →