CVE-2019-25002: 
Rust vulnerability analysis and mitigation

An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. The vulnerability lies in the generichash::Digest::eq implementation, which compares itself to itself and thus has degenerate security properties (RustSec Advisory).

The vulnerability affects the PartialEq implementation for generichash::Digest where Digest::eq always returns true and Digest::ne always returns false because it compares itself to itself instead of comparing against the provided value. This issue impacts versions prior to 0.2.5 and has a CVSS v3.1 base score of 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (RustSec Advisory).

Due to the incorrect implementation of equality comparison, any hash comparison using this function will always return true, effectively breaking the security properties of the hash comparison. This could lead to authentication bypasses or other security issues where hash comparison is used for verification (RustSec Advisory).

The vulnerability is easily exploitable as it requires no special privileges, user interaction, or complex attack vectors. The broken comparison function will always return true regardless of the input, making it trivial to bypass any security checks that rely on this comparison (RustSec Advisory).

Users should upgrade to sodiumoxide version 0.2.5 or later which contains the fix for this vulnerability. The issue was patched by correcting the implementation of the equality comparison function (RustSec Advisory).