PT-2019-16427 · Rust+1 · Failure+1
Qwaz
·
Publicado
2019-11-13
·
Atualizado
2024-08-04
·
CVE-2019-25010
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
failure crate versions through 0.1.5
failure crate versions through 2019-11-13
Description
The issue is related to type confusion that can occur when
private get type id is overridden, leading to undefined behavior when downcasting. This can happen when safe Rust code implements malfunctioning private get type id. Users who derive the Fail trait are not affected.Recommendations
For versions through 0.1.5, consider switching to an actively developed alternative such as
anyhow, eyre, fehler, snafu, or thiserror to mitigate the risk.
For versions through 2019-11-13, consider switching to an actively developed alternative such as anyhow, eyre, fehler, snafu, or thiserror to mitigate the risk.
As a temporary workaround, consider avoiding the use of private get type id until a more stable solution is available.Correção
Type Confusion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Failure