PT-2020-17512 · Rust · Bigint

Published 2020-05-07 · Updated 2021-08-25 · CVE-2020-35880

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bigint crate through 2020-05-07

Description An issue was discovered in the bigint crate, allowing a soundness violation. The bigint crate is not maintained anymore and contains several known bugs, including a soundness bug.

Recommendations For versions through 2020-05-07, consider using the uint crate instead, as the bigint crate is no longer maintained and contains known bugs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2020-35880

GHSA-WGX2-6432-J3FW

RUSTSEC-2020-0025

Affected Products

Bigint

References · 10

• https://osv.dev/vulnerability/CVE-2020-35880 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0025 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2020-0025.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-35880 · Security Note
• https://osv.dev/vulnerability/GHSA-wgx2-6432-j3fw · Vendor Advisory
• https://github.com/rustsec/advisory-db/pull/290 · Note
• https://github.com/paritytech/bigint · Note
• https://github.com/paritytech/bigint/commit/7e71521a61b009afc94c91135353102658550d42 · Note
• https://t.me/cibsecurity/21471 · Telegram Post
• https://crates.io/crates/bigint · Note