GHSA-jq66-xh47-j9f3

Type confusion if __private_get_type_id__ is overriden

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-25575

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	failure	<= 0.1.8	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-25575 advisory
https://github.com/rust-lang-nursery/failure/issues/336 web
https://github.com/RustCrypto/hashes/pull/91 web
https://boats.gitlab.io/blog/post/failure-to-fehler web
https://github.com/RustSec/advisory-db/blob/main/crates/failure/RUSTSEC-2019-0036.md web
https://rustsec.org/advisories/RUSTSEC-2019-0036.html web
https://rustsec.org/advisories/RUSTSEC-2020-0036.html web