CVE-2020-25576
An issue was discovered in the rand_core crate before 0.4.2 for Rust. ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Azure Linux. Niedriger laut Ubuntu (mittel).
Beschreibung
An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | kata-containers | 0:3.2.0.azl2-3.azl3 |
| cargo::GitHub Security Advisory Rust | rand_core | 0.4.2, 0.3.1 |
| debian 10 | rust-rand-core, rust-rand-core-0.2 | kein Fix angegeben |
| debian 11 | rust-rand-core | 0.5.0-1 |
| debian 12 | rust-rand-core | 0.5.0-1 |
| debian 13 | rust-rand-core | 0.5.0-1 |
| debian 14 | rust-rand-core | 0.5.0-1 |
| echo | rust-rand-core | 0.5.0-1 |
| ubuntu 20.04-ESM | rust-rand-core-0.2, rust-rand-core-0.3 | kein Fix angegeben |
Alle 11 Einträge aus 9 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | kata-containers | 0:3.2.0.azl2-3.azl3 |
| cargo::GitHub Security Advisory Rust | rand_core | 0.4.2, 0.3.1 |
| debian 10 | rust-rand-core | kein Fix angegeben |
| debian 10 | rust-rand-core-0.2 | kein Fix angegeben |
| debian 11 | rust-rand-core | 0.5.0-1 |
| debian 12 | rust-rand-core | 0.5.0-1 |
| debian 13 | rust-rand-core | 0.5.0-1 |
| debian 14 | rust-rand-core | 0.5.0-1 |
| echo | rust-rand-core | 0.5.0-1 |
| ubuntu 20.04-ESM | rust-rand-core-0.2 | kein Fix angegeben |
| ubuntu 20.04-ESM | rust-rand-core-0.3 | kein Fix angegeben |
Referenzen
- https://github.com/rust-random/rand
- https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06
- https://github.com/rust-random/rand/security/advisories/GHSA-mmc9-pwm7-qj5w
- https://nvd.nist.gov/vuln/detail/CVE-2020-25576
- https://rustsec.org/advisories/RUSTSEC-2019-0035.html
- https://www.cve.org/CVERecord?id=CVE-2020-25576