Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-43620

An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-43620
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 12:00 UTC · Revision 1

Source evidence

CVE-2021-43620

core-osv · Original source

Published 15 Nov 2021, 05:15 UTC

An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string.

osv:CVE-2021-43620
Complete source record
{
  "id": "9a825689e466814f0b8c6f394a4e74c56d71d8315448ad3cd70b77b9b4d94f20",
  "url": "https://osv.dev/vulnerability/CVE-2021-43620",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-43620",
    "summary": "An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\\0' byte, which might not be the end of the string.",
    "evidence": "osv:CVE-2021-43620",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-43620",
      "aliases": [
        "CVE-2021-43620",
        "GHSA-h352-g5vw-3926",
        "RUSTSEC-2021-0123"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nvzqz/fruity",
              "type": "GIT",
              "events": [
                {
                  "introduced": "335d33559d94b2ad2ac24d0381eb570355a466b1"
                },
                {
                  "last_affected": "c1d067e8ec03e20bb6f52f7c3ab63cadd2a2b261"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:fruity_project:fruity:0.1.0:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "0.1.0"
                      },
                      {
                        "last_affected": "0.1.0"
                      }
                    ],
                    "source": "CPE_STRING"
                  },
                  {
                    "cpe": "cpe:2.3:a:fruity_project:fruity:0.2.0:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "0.2.0"
                      },
                      {
                        "last_affected": "0.2.0"
                      }
                    ],
                    "source": "CPE_STRING"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.1.0",
            "0.2.0",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43620.json"
          }
        }
      ],
      "modified": "2026-10-20T10:55:02.911089770Z",
      "provider": "osv",
      "references": [
        "https://github.com/nvzqz/fruity/issues/14",
        "https://github.com/rustsec/advisory-db/pull/1102",
        "https://rustsec.org/advisories/RUSTSEC-2021-0123.html"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-43620",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 386774,
  "published_at": "2021-11-15T05:15:07.913+00:00"
}