CVE-2019-1010299
published 2019-07-15CVE-2019-1010299: The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.52%
71.7th percentile
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rustc | < rustc 1.30.0+dfsg1-1 (bookworm) | rustc 1.30.0+dfsg1-1 (bookworm) |
| rust-lang | rust | >= 1.18.0 < 1.30.0 | 1.30.0 |
| the_rust_programming_language | standard_library | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2019-1010299: rustc - The Rust Programming Language Standard Library 1.18.0 and later is affected by: ...
vendor_debian·2019·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CVE-2019-1010299: rustc - The Rust Programming Language Standard Library 1.18.0 and later is affected by: ...
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
Scope: local
bookworm: resolved (fixed in 1.30.0+dfsg1-1)
bullseye: resolved (fixed in 1.30.0+dfsg1-1)
forky: resolved (fixed in 1.30.0+dfsg1-1)
sid: resolved (fixed in 1.30.0+dfsg1-1)
trixie: resolved (fixed in 1.30.0+dfsg1-1)
Red Hat
rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter
vendor_redhat·2018-08-21·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CWE-200 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter
rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
Package: rust-toolset:rhel8/rust (Red Hat Enterprise Linux 8) - Not affected
GHSA
GHSA-q36q-x6v6-cvmp: The Rust Programming Language Standard Library 1
ghsa_unreviewed·2022-05-24
CVE-2019-1010299 [MEDIUM] GHSA-q36q-x6v6-cvmp: The Rust Programming Language Standard Library 1
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
OSV
CVE-2019-1010299: The Rust Programming Language Standard Library 1
osv·2019-07-15·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CVE-2019-1010299: The Rust Programming Language Standard Library 1
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter
bugzilla·2019-08-01·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter
The Rust Programming Language Standard Library 1.18.0 and later is affected by an Information Exposure vulnerability. Contents of uninitialized memory could be printed to string or to log file in the debug trait implementation for std::collections::vec_deque::Iter when the program invokes the debug printing for an iterator over an empty VecDeque.
References:
https://github.com/rust-lang/rust/issues/53566
Upstream Patch:
https://github.com/rust-lang/rust/pull/53571/commits/b85e4cc8fadaabd41da5b9645c08c68b8f89908d
Discussion:
Created rust tracking bugs for this issue:
Affects: epel-7 [bug 1736771]
Affects: fedora-29 [bug 1736769]
Affects: fedora-30 [bug 1736770]
Bugzilla
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [fedora-30]
bugzilla·2019-08-01·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [fedora-30]
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [fedora-30]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-30.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mess
Bugzilla
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [epel-7]
bugzilla·2019-08-01·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [epel-7]
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [fedora-29]
bugzilla·2019-08-01·CVSS 5.3
CVE-2019-1010299 [MEDIUM] CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [fedora-29]
CVE-2019-1010299 rust: print of uninitialized memory in the debug trait implementation for std::collections::vec_deque::Iter [fedora-29]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-29.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mess
2019-07-15
Published