CVE-2018-20999
Flaw in streaming state in orion
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
- Record
CVE-2018-20999- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-682
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
- Record
CVE-2018-20999- Updated
- 2026-11-02
EUVDEUVD-2021-1720 No score
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
- Record
EUVD-2021-1720- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gffv-5hr2-f9gj
Flaw in streaming state in orion
Affected versions of this crate did not properly reset a streaming state. Resetting a streaming state, without finalising it first, creates incorrect results. The flaw was corrected by not first checking if the state had already been reset, when calling reset().
- Record
GHSA-gffv-5hr2-f9gj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-682
- Updated
- 2026-11-02
OSV
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
- Record
CVE-2018-20999- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-gffv-5hr2-f9gj
Flaw in streaming state in orion
Affected versions of this crate did not properly reset a streaming state. Resetting a streaming state, without finalising it first, creates incorrect results. The flaw was corrected by not first checking if the state had already been reset, when calling reset().
- Record
GHSA-gffv-5hr2-f9gj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-682
- Updated
- 2026-11-02
OSVRUSTSEC-2018-0012
Flaw in streaming state reset() functions can create incorrect results.
Affected versions of this crate did not properly reset a streaming state.
Resetting a streaming state, without finalising it first, creates incorrect results.
The flaw was corrected by not first checking if the state had already been reset, when calling reset().
- Record
RUSTSEC-2018-0012- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20999 is a high vulnerability (CVSS 7.5) in Orion Project Orion, published December 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in orion 0.11.2.