CVE-2019-25010 — Vulnerability in failure — CVE Details
CRITICAL
Type confusion if __private_get_type_id__ is overriden
Published June 16, 2022Updated July 3, 2024Source: osv
Summary
An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010.
Advisory Timeline
- First published June 16, 2022 (1579 days ago).
- Last revised July 3, 2024 — 748 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: crates.io (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| failure | crates.io | All versions | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-843
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-25575ADVISORY
- https://github.com/rust-lang-nursery/failure/issues/336WEB
- https://github.com/RustCrypto/hashes/pull/91WEB
- https://boats.gitlab.io/blog/post/failure-to-fehlerWEB
- https://github.com/RustSec/advisory-db/blob/main/crates/failure/RUSTSEC-2019-0036.mdWEB
- https://rustsec.org/advisories/RUSTSEC-2019-0036.htmlWEB
- https://rustsec.org/advisories/RUSTSEC-2020-0036.htmlWEB
Frequently Asked Questions
- What is CVE-2019-25010?
- Type confusion if __private_get_type_id__ is overriden This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2019-25010?
- CVE-2019-25010 affects failure. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-25010 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.8
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-jq66-xh47-j9f3
CVE-2020-25575
GHSA-r98r-j25q-rmpr
RUSTSEC-2019-0036
RUSTSEC-2020-0036
Related CVEs
- RUSTSEC-2026-0327CRITICAL
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
- CVE-2026-75856CRITICAL
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies