CVE-2018-20989 Integer underflow in untrusted
An integer underflow in the untrusted crate's error handling causes a panic, leading to denial of service for applications using this Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20989?
CVE-2018-20989 is a high-severity vulnerability in n/a, published on 26 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
Weakness: CWE-191
Which versions are affected by CVE-2018-20989?
3 open source packages ship an affected version, including untrusted. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
untrusted crates.io | All versions | 0.6.2 |
untrusted crates.io | All versions | 0.6.2 |
untrusted crates.io | From 0.0.0-0 | 0.6.2 |
Products include Untrusted Project Untrusted.
How do I fix CVE-2018-20989?
Upgrade untrusted to 0.6.2 or later.
Is CVE-2018-20989 being exploited?
There is no known exploitation of CVE-2018-20989 in the wild and no public exploit code.
Sources
Also known as GHSA-wq8f-46ww-6c2h, RUSTSEC-2018-0001, UBUNTU-CVE-2018-20989.