CVE-2020-35890

Name of the Vulnerable Software and Affected Versions ordnung crate versions through 0.0.1

Description The issue concerns the compact::Vec in the ordnung crate, which violates memory safety. This occurs via out-of-bounds access for large capacity and through the remove() function, which is not panic-safe and can cause a double-free when an index larger than the length is provided. Additionally, there's a 32-bit / allocator layout mismatch in 64-bit environments.

Recommendations For ordnung crate versions through 0.0.1, consider disabling the compact::Vec until a patch is available to prevent out-of-bounds access and double-free issues. Restrict the use of the remove() function to prevent double-free errors. At the moment, there is no information about a newer version that contains a fix for this issue.