sqlx-0.6.0.crate: 2 vulnerabilities (highest severity is: 7.8)

[mend-bolt-for-github]

Vulnerable Library - sqlx-0.6.0.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (sqlx version)	Remediation Possible**
WS-2023-0094	High	7.8	spin-0.9.3.crate	Transitive	N/A*	❌
CVE-2022-35737	High	7.5	libsqlite3-sys-0.24.2.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2023-0094

Vulnerable Library - spin-0.9.3.crate

Spin-based synchronization primitives

Library home page: https://crates.io/api/v1/crates/spin/0.9.3/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• sqlx-0.6.0.crate (Root Library)
  • sqlx-core-0.6.0.crate
    • flume-0.10.12.crate
      • ❌ spin-0.9.3.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In spin prior to 0.9.8 Once::try_call_once is unsound if invoked more than once concurrently and any call fails to initialise successfully.

Publish Date: 2024-11-03

URL: WS-2023-0094

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2qv5-7mw5-j3cg

Release Date: 2023-04-04

Fix Resolution: spin - 0.9.8

Step up your Open Source Security Game with Mend here

CVE-2022-35737

Vulnerable Library - libsqlite3-sys-0.24.2.crate

Native bindings to the libsqlite3 library

Library home page: https://crates.io/api/v1/crates/libsqlite3-sys/0.24.2/download

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• sqlx-0.6.0.crate (Root Library)
  • sqlx-core-0.6.0.crate
    • ❌ libsqlite3-sys-0.24.2.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Publish Date: 2022-08-03

URL: CVE-2022-35737

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2022-35737

Release Date: 2022-08-03

Fix Resolution: version-3.39.2

Step up your Open Source Security Game with Mend here