CVE-2020-25795: Memory Safety Issue in rust-sized-chunks Package
Summary
CVE-2020-25791: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can have a memory-safety issue upon a panic. Affects rust-sized-chunks versions < ebd64cc8a4f417a0df8c3db177fdfe08da96b496. No fix is published. How to fix ↓
Also tracked for
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
- sized-chunks · crates.io
The same CVE-2020-25791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-sized-chunks package is a Rust library designed to handle chunked data efficiently. It allows developers to work with data in manageable sizes, improving performance and memory usage in applications that require processing large datasets. However, this package has been found to have a memory safety vulnerability that could lead to potential application crashes or data corruption.
Vulnerability Detail
An issue was discovered in the sized-chunks crate through version 0.6.2 for Rust. The vulnerability arises in the Chunk implementation, specifically within the insert_from function, which can encounter a memory-safety issue during a panic. This flaw could allow an attacker to exploit the application, leading to unexpected behavior or crashes, thereby compromising the integrity of the application and potentially exposing sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional error handling in your application to manage potential panics gracefully. This may involve wrapping calls to the insert_from function in a try-catch block or using Rust's Result type to handle errors more effectively.
Conclusion
CVE-2020-25795 represents a significant memory safety vulnerability in the rust-sized-chunks package that can lead to serious application issues. It is crucial for developers using this package to update to the latest version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rust-sized-chunks →
FAQ
CVE-2020-25795 is a vulnerability identified in the rust-sized-chunks package that can lead to memory safety issues during a panic in the insert_from function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could lead to application crashes, data corruption, or unauthorized access to sensitive information.
Yes, it is recommended to upgrade to version 0.6.5-1 or later to mitigate the vulnerability.
The CVSS score for CVE-2020-25795 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rust-sized-chunks.
