CVE-2020-25576

Name	CVE-2020-25576
Description	An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	969911, 970185, 970186

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-rand-core (PTS)	buster	0.3.0-1	vulnerable
	bullseye	0.5.1-1	fixed
	bookworm	0.6.3-2	fixed
	sid, trixie	0.6.4-1	fixed
rust-rand-core-0.2 (PTS)	buster	0.2.2-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
rust-rand-core	source	(unstable)	0.5.0-1	low	969911
rust-rand-core-0.2	source	(unstable)	(unfixed)	low	970185
rust-rand-core-0.3	source	(unstable)	(unfixed)	low	970186

Notes

[buster] - rust-rand-core <ignored> (Minor issue)
[buster] - rust-rand-core-0.2 <ignored> (Minor issue)
https://rustsec.org/advisories/RUSTSEC-2019-0035.html
https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06