PT-2019-16427 · Rust+1 · Failure+1
Qwaz
·
Published
2019-11-13
·
Updated
2024-08-04
·
CVE-2019-25010
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
failure crate versions through 0.1.5
failure crate versions through 2019-11-13
Description
The issue is related to type confusion that can occur when
private get type id is overridden, leading to undefined behavior when downcasting. This can happen when safe Rust code implements malfunctioning private get type id. Users who derive the Fail trait are not affected.Recommendations
For versions through 0.1.5, consider switching to an actively developed alternative such as
anyhow, eyre, fehler, snafu, or thiserror to mitigate the risk.
For versions through 2019-11-13, consider switching to an actively developed alternative such as anyhow, eyre, fehler, snafu, or thiserror to mitigate the risk.
As a temporary workaround, consider avoiding the use of private get type id until a more stable solution is available.Fix
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Failure