Skip to content

Report use-after-free issue in diesels sqlite backend #809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 5, 2021

Conversation

weiznich
Copy link
Contributor

@weiznich weiznich commented Mar 4, 2021

We've discovered a use-after-free issue in diesel's sqlite backend, which can be triggered by real world code. See the corresponding PR (diesel-rs/diesel#2663) for details.

Copy link
Member

@Shnatsel Shnatsel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the report!

I understand the fixed version is not yet live? We'd prefer to issue an advisory once a patched version is available on crates.io.

Co-authored-by: Sergey "Shnatsel" Davidoff <[email protected]>
@weiznich
Copy link
Contributor Author

weiznich commented Mar 5, 2021

The fixed version is not live yet. I've opened this PR to just have something in place to go as soon at the code is ready. I will add another comment here as soon as this is the case.

@weiznich
Copy link
Contributor Author

weiznich commented Mar 5, 2021

I've published the 1.4.6 release some minutes back.

Co-authored-by: Sergey "Shnatsel" Davidoff <[email protected]>
@Shnatsel
Copy link
Member

Shnatsel commented Mar 5, 2021

Thanks!

@Shnatsel Shnatsel merged commit 34e9863 into rustsec:master Mar 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants