CVE-2020-25576

Name of the Vulnerable Software and Affected Versions rand core versions prior to 0.4.2

Description An issue was discovered in the rand core crate where casting of byte slices to integer slices mishandles alignment constraints, resulting in undefined behavior. The functions rand core::BlockRng::next u64 and rand core::BlockRng::fill bytes are affected.

Recommendations For versions prior to 0.4.2, update to version 0.4.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of rand core::BlockRng::next u64 and rand core::BlockRng::fill bytes functions until the update is applied.