PT-2019-19977 · Rust · Rand Core

Publicado 2019-04-19 · Atualizado 2021-08-25 · CVE-2020-25576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rand core versions prior to 0.4.2

Description An issue was discovered in the rand core crate where casting of byte slices to integer slices mishandles alignment constraints, resulting in undefined behavior. The functions rand core::BlockRng::next u64 and rand core::BlockRng::fill bytes are affected.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of rand core::BlockRng::next u64 and rand core::BlockRng::fill bytes functions until the update is applied.

Correção

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

CVE-2020-25576

GHSA-MMC9-PWM7-QJ5W

RUSTSEC-2019-0035

Produtos afetados

Rand Core

Referências · 14

• https://github.com/rust-random/rand · Nota
• https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06 · Nota
• https://github.com/rust-random/rand/security/advisories/GHSA-mmc9-pwm7-qj5w · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-25576 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2020-25576 · Nota de Segurança
• https://crates.io/crates/rand_core · Nota
• https://osv.dev/vulnerability/GHSA-mmc9-pwm7-qj5w · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-25576 · Aviso do Fabricante
• https://rustsec.org/advisories/RUSTSEC-2019-0035.html · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0035 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2020-25576 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2020-25576 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25576 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25576 · Aviso do Fabricante