HIGH7.5

GHSA-gffv-5hr2-f9gj

Flaw in streaming state in orion

Details

Affected versions of this crate did not properly reset a streaming state. Resetting a streaming state, without finalising it first, creates incorrect results. The flaw was corrected by not first checking if the state had already been reset, when calling reset().

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/orion

Introduced in: 0Fixed in: 0.11.2

Upgrade orion to 0.11.2 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2018-20999[ADVISORY]
https://github.com/brycx/orion/issues/46[WEB]
https://github.com/brycx/orion[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2018-0012.html[WEB]