CVE-2020-25576
An issue was discovered in the rand_core crate before 0.4.2 for Rust. ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Azure Linux. Rated lower by Ubuntu (medium).
Description
An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | kata-containers | 0:3.2.0.azl2-3.azl3 |
| cargo::GitHub Security Advisory Rust | rand_core | 0.4.2, 0.3.1 |
| debian 10 | rust-rand-core, rust-rand-core-0.2 | no fix listed |
| debian 11 | rust-rand-core | 0.5.0-1 |
| debian 12 | rust-rand-core | 0.5.0-1 |
| debian 13 | rust-rand-core | 0.5.0-1 |
| debian 14 | rust-rand-core | 0.5.0-1 |
| echo | rust-rand-core | 0.5.0-1 |
| ubuntu 20.04-ESM | rust-rand-core-0.2, rust-rand-core-0.3 | no fix listed |
Show all 11 entries from 9 sources
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | kata-containers | 0:3.2.0.azl2-3.azl3 |
| cargo::GitHub Security Advisory Rust | rand_core | 0.4.2, 0.3.1 |
| debian 10 | rust-rand-core | no fix listed |
| debian 10 | rust-rand-core-0.2 | no fix listed |
| debian 11 | rust-rand-core | 0.5.0-1 |
| debian 12 | rust-rand-core | 0.5.0-1 |
| debian 13 | rust-rand-core | 0.5.0-1 |
| debian 14 | rust-rand-core | 0.5.0-1 |
| echo | rust-rand-core | 0.5.0-1 |
| ubuntu 20.04-ESM | rust-rand-core-0.2 | no fix listed |
| ubuntu 20.04-ESM | rust-rand-core-0.3 | no fix listed |
References
- https://github.com/rust-random/rand
- https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06
- https://github.com/rust-random/rand/security/advisories/GHSA-mmc9-pwm7-qj5w
- https://nvd.nist.gov/vuln/detail/CVE-2020-25576
- https://rustsec.org/advisories/RUSTSEC-2019-0035.html
- https://www.cve.org/CVERecord?id=CVE-2020-25576