CVE-2019-25005

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://rustsec.org/advisories/RUSTSEC-2019-0029.htmlThird Party Advisory
https://rustsec.org/advisories/RUSTSEC-2019-0029.htmlThird Party Advisory

Timeline

Published: Dec 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-250067.5An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.CVE-2019-250077.5An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.CVE-2019-250099.8An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.CVE-2019-25013.8Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are CVE-2019-250109.8An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridde CVE-2019-250115.4NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dc CVE-2019-250127.5The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This proj CVE-2019-250135.9The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR e CVE-2019-250146.5A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular CVE-2019-250155.4LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.CVE-2019-250168.8In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed CVE-2019-250175.9An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses