RUSTSEC-2020-0089: 
Rust vulnerability analysis and mitigation

An issue was discovered in the nanorand crate before version 0.5.1 for Rust programming language. The vulnerability was assigned CVE-2020-35926 and was publicly disclosed on December 31, 2020. The vulnerability affected the random number generation functionality in the nanorand library (NVD, CVE).

The vulnerability stems from incorrect conversion between numeric types (CWE-681) and use of insufficiently random values (CWE-330). The issue caused any random number generator, including the ChaCha implementation, to return all zeroes due to integer truncation being mishandled. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability compromises the cryptographic security of applications using the nanorand crate, as the random number generator would only generate zero values instead of random numbers. This could severely impact any security-critical operations that rely on random number generation, such as cryptographic operations or security token generation (NVD).

The vulnerability is highly exploitable due to its network accessibility (AV:N), low attack complexity (AC:L), and no requirements for privileges (PR:N) or user interaction (UI:N). This is reflected in the critical CVSS score of 9.8 (NVD).

The vulnerability was fixed in nanorand version 0.5.1. Users are advised to upgrade to this version or newer to address the issue. The fix addresses the integer truncation problem that caused the random number generation failure (RustSec).