What is GHSA-r98r-j25q-rmpr?

GHSA-r98r-j25q-rmpr is a security advisory published by GitHub Security Advisories with Critical severity. Rust Failure Crate Vulnerable to Type confusion

Which CVE IDs does GHSA-r98r-j25q-rmpr cover?

GHSA-r98r-j25q-rmpr covers the following CVE IDs: CVE-2019-25010. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r98r-j25q-rmpr?

GHSA-r98r-j25q-rmpr has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-r98r-j25q-rmpr?

GHSA-r98r-j25q-rmpr affects 1 product, including: rust/failure:\u003c= 0.1.8.

GHSA-r98r-j25q-rmprCriticalCVSS 9.8

Rust Failure Crate Vulnerable to Type confusion

Vendor

GitHub Security Advisories

Published

August 25, 2021

Last Modified

November 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-25010 →

📋 Description

Safe Rust code can implement malfunctioning __private_get_type_id__ and cause type confusion when downcasting, which is an undefined behavior.

Users who derive Fail trait are not affected.

🎯 Affected products1

rust/failure:<= 0.1.8

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-25010
https://github.com/rust-lang-nursery/failure/issues/336
https://rustsec.org/advisories/RUSTSEC-2019-0036.html
https://github.com/advisories/GHSA-r98r-j25q-rmpr