This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate semver


(3 total, 1 insecure)

 semver-parser^ to date
 serde^ to date

Dev dependencies

(2 total, all up-to-date)

 serde_derive^ to date
 serde_json^ to date

Security Vulnerabilities

diesel: Fix a use-after-free bug in diesels Sqlite backend


We've misused sqlite3_column_name. The SQLite documentation states that the following:

The returned string pointer is valid until either the prepared statement is destroyed by sqlite3_finalize() or until the statement is automatically reprepared by the first call to sqlite3_step() for a particular run or until the next call to sqlite3_column_name() or sqlite3_column_name16() on the same column.

As part of our query_by_name infrastructure we've first received all field names for the prepared statement and stored them as string slices for later use. After that we called sqlite3_step() for the first time, which invalids the pointer and therefore the stored string slice.