CVE-2020-25576
An issue was discovered in the rand_core crate before 0.4.2 for Rust. ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Azure Linux. Daha düşük diyenler: Ubuntu (orta).
Açıklama
An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Azure Linux 3.0 | kata-containers | 0:3.2.0.azl2-3.azl3 |
| cargo::GitHub Security Advisory Rust | rand_core | 0.4.2, 0.3.1 |
| debian 10 | rust-rand-core, rust-rand-core-0.2 | düzeltme belirtilmemiş |
| debian 11 | rust-rand-core | 0.5.0-1 |
| debian 12 | rust-rand-core | 0.5.0-1 |
| debian 13 | rust-rand-core | 0.5.0-1 |
| debian 14 | rust-rand-core | 0.5.0-1 |
| echo | rust-rand-core | 0.5.0-1 |
| ubuntu 20.04-ESM | rust-rand-core-0.2, rust-rand-core-0.3 | düzeltme belirtilmemiş |
9 kaynaktaki 11 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Azure Linux 3.0 | kata-containers | 0:3.2.0.azl2-3.azl3 |
| cargo::GitHub Security Advisory Rust | rand_core | 0.4.2, 0.3.1 |
| debian 10 | rust-rand-core | düzeltme belirtilmemiş |
| debian 10 | rust-rand-core-0.2 | düzeltme belirtilmemiş |
| debian 11 | rust-rand-core | 0.5.0-1 |
| debian 12 | rust-rand-core | 0.5.0-1 |
| debian 13 | rust-rand-core | 0.5.0-1 |
| debian 14 | rust-rand-core | 0.5.0-1 |
| echo | rust-rand-core | 0.5.0-1 |
| ubuntu 20.04-ESM | rust-rand-core-0.2 | düzeltme belirtilmemiş |
| ubuntu 20.04-ESM | rust-rand-core-0.3 | düzeltme belirtilmemiş |
Referanslar
- https://github.com/rust-random/rand
- https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06
- https://github.com/rust-random/rand/security/advisories/GHSA-mmc9-pwm7-qj5w
- https://nvd.nist.gov/vuln/detail/CVE-2020-25576
- https://rustsec.org/advisories/RUSTSEC-2019-0035.html
- https://www.cve.org/CVERecord?id=CVE-2020-25576