CVE-2019-25006
Incorrect implementation of the Streebog hash functions in streebog
CVE-2019-25006 is a high vulnerability (CVSS 7.5) in Streebog Project Streebog, published October 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in streebog 0.8.0.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 0.85%EPSS, 58th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.8.0streebog +2 more
Description
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
- Record
CVE-2019-25006- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-327
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
- Record
CVE-2019-25006- Updated
- 2026-11-02
EUVDEUVD-2021-1719No score
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
- Record
EUVD-2021-1719- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gf93-h79q-6jjv
Incorrect implementation of the Streebog hash functions in streebog
Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs.
- Record
GHSA-gf93-h79q-6jjv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVGHSA-39wr-f4ff-xm6p
Incorrect implementation in streebog
Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs.
- Record
GHSA-39wr-f4ff-xm6p- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVGHSA-gf93-h79q-6jjv
Incorrect implementation of the Streebog hash functions in streebog
Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs.
- Record
GHSA-gf93-h79q-6jjv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVRUSTSEC-2019-0030No score
Incorrect implementation of the Streebog hash functions
Internal update-sigma function was implemented incorrectly and depending on
debug-assertions it could've caused an incorrect result or panic for certain
inputs.
- Record
RUSTSEC-2019-0030- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | ||
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.