Threats affecting pkg:cargo/diesel

Diesel's SQLite backend incorrectly assumed that strings returned by sqlite3_value_text are always valid UTF-8. This assumption led to unsafe Rust code that could interpret arbitrary bytes from SQLite BLOB fields as UTF-8 strings, violating Rust's safety guarantees. The issue is fixed in Diesel version 2.3.8, which properly validates UTF-8 encoding before constructing string slices.

A vulnerability in Diesel's SQLite backend arises from incorrect assumptions about UTF-8 encoding when deserializing query results. Diesel used the sqlite3_value_text function assuming it always returns valid UTF-8 strings, but for SQLite BLOB types, this can contain arbitrary bytes, violating Rust's string safety guarantees. This issue is fixed in Diesel version 2.3.8.