CVE-2019-1010299 Information disclosure in Standard Library

What is CVE-2019-1010299?

CVE-2019-1010299 is a medium-severity vulnerability in The Rust Programming Language Standard Library, published on 15 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.

Weakness: CWE-908, CWE-200

Which versions are affected by CVE-2019-1010299?

It affects 1 product.

Products include Rust-Lang Rust.

How do I fix CVE-2019-1010299?

Upgrade to a fixed version.

Is CVE-2019-1010299 being exploited?

There is no known exploitation of CVE-2019-1010299 in the wild and no public exploit code.

Other vulnerabilities in The Rust Programming Language Standard Library

• CVE-2020-36318 Use after free in n/a Critical 9.8
• CVE-2018-1000810 Integer overflow in n/a Critical 9.8
• CVE-2021-29922 Security feature bypass in n/a Critical 9.1
• CVE-2024-43402 Rust OS Command Injection/Argument Injection vulnerability High 8.2
• CVE-2018-1000657 Memory corruption in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-1010299, GHSA-q36q-x6v6-cvmp.