CVE-2020-25791: Rust-sized-chunks Package Vulnerability Due to Unchecked Array Size
Summary
CVE-2020-25792: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. Affects rust-sized-chunks versions < ebd64cc8a4f417a0df8c3db177fdfe08da96b496. No fix is published. How to fix ↓
Also tracked for
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
The same CVE-2020-25792 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-sized-chunks package is a Rust library designed to facilitate the manipulation of collections by dividing them into smaller, manageable chunks. This functionality is essential for developers who need to process large datasets efficiently. However, the package has a critical vulnerability that arises from the Chunk implementation, where the array size is not validated during construction. This oversight can lead to unexpected behavior and potential crashes in applications using this library.
Vulnerability Detail
CVE-2020-25791 is a vulnerability found in the sized-chunks crate, specifically in versions up to 0.6.2. The issue stems from the lack of checks on the array size when constructed with the unit() function. This can result in out-of-bounds access, leading to application crashes or undefined behavior. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level that could significantly impact applications relying on this library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation in your application to ensure that the array sizes passed to the sized-chunks library are within acceptable limits. This can help mitigate the risk of out-of-bounds access until the package is updated.
Conclusion
CVE-2020-25791 presents a significant risk to applications using the rust-sized-chunks package due to unchecked array sizes. It is crucial for developers to update to the latest version to mitigate this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rust-sized-chunks →
FAQ
CVE-2020-25791 is a vulnerability in the rust-sized-chunks package that allows for unchecked array sizes, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-25791 is 7.5, indicating a high severity level.
If you cannot update the package, implement input validation to ensure array sizes are within acceptable limits as a temporary workaround.
More information can be found in the official CVE database or by visiting the GitHub repository for the sized-chunks crate.
Related vulnerabilities
Recent vulnerabilities recorded for rust-sized-chunks.
