PT-2018-15492 · Rust · Orion Crate

Brycx · Published 2018-12-20 · Updated 2021-08-25 · CVE-2018-20999

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions orion crate versions prior to 0.11.2

Description An issue in the orion crate causes incorrect results when reset() is called without first finalizing the streaming state. This occurs because the state is not properly reset. The flaw was corrected by changing the behavior of the reset() call to not check if the state had already been reset.

Recommendations For versions prior to 0.11.2, update to version 0.11.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the reset() function without first finalizing the streaming state to minimize the risk of incorrect results.

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2018-20999

GHSA-GFFV-5HR2-F9GJ

RUSTSEC-2018-0012

Affected Products

Orion Crate

References · 8

• https://github.com/brycx/orion/issues/46 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-20999 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20999 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2018-0012 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gffv-5hr2-f9gj · Vendor Advisory
• https://github.com/brycx/orion · Note
• https://rustsec.org/advisories/RUSTSEC-2018-0012.html · Note
• https://crates.io/crates/orion · Note