PT-2019-16419 · Rust · Sodiumoxide

Published 2019-10-11 · Updated 2021-08-25 · CVE-2019-25002

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sodiumoxide crate versions 0.2.0 through 0.2.4

Description An issue was discovered in the sodiumoxide crate for Rust, where the generichash::Digest::eq function compares itself to itself, resulting in degenerate security properties. This means that Digest::eq always returns true and Digest::ne always returns false, due to the incorrect implementation of the PartialEq trait for generichash::Digest.

Recommendations For versions 0.2.0 through 0.2.4, update to version 0.2.5 or later to resolve the issue. As a temporary workaround, consider disabling the use of generichash::Digest::eq and generichash::Digest::ne functions until a patch is available.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2019-25002

GHSA-WRVC-72W7-XPMJ

RUSTSEC-2019-0026

Affected Products

Sodiumoxide

References · 13

• https://osv.dev/vulnerability/GHSA-wrvc-72w7-xpmj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25002 · Security Note
• https://rustsec.org/advisories/RUSTSEC-2019-0026.html · Patch
• https://osv.dev/vulnerability/RUSTSEC-2019-0026 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25002 · Vendor Advisory
• https://github.com/sodiumoxide/sodiumoxide/pull/381 · Note
• https://github.com/sodiumoxide/sodiumoxide/pull/381/commits/fae052b834b097ced9a89a8fff8466e18f383070 · Note
• https://github.com/sodiumoxide/sodiumoxide/commit/38490723927f230498adf795153e6cd3cb08b6a8 · Note
• https://github.com/sodiumoxide/sodiumoxide · Note
• https://crates.io/crates/sodiumoxide · Note
• https://t.me/cibsecurity/21464 · Telegram Post
• https://t.me/cvenotify/8018 · Telegram Post
• https://t.me/cvenotify/8522 · Telegram Post