Advisories for Cargo/Failure package

2022

Type confusion if __private_get_type_id__ is overriden

An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010.

2021

Rust Failure Crate Vulnerable to Type confusion

Safe Rust code can implement malfunctioning private_get_type_id and cause type confusion when downcasting, which is an undefined behavior. Users who derive Fail trait are not affected.