Most recent entries from all

bdu:2023-00687

Withdrawn: BELL-CVE-2022-46176 — CVE-2022-46176 does not affect BellSoft software

Withdrawn by the publisher.

CLEANSTART-2026-KA82053 — Security fix for CVE-2022-46176 applied in: rust 1.66.1-r0

Affected: CleanStart: rust

Security vulnerability affects the rust package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-221686

fkie_cve-2022-46176

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible.

GHSA-r5w3-xm58-jv6j — Cargo did not verify SSH host keys

Affected: crates.io: cargo

The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks.

This vulnerability has been assigned CVE-2022-46176.

## Overview

When an SSH client establishes communication with a server, to prevent MITM attacks the client should check whether it already communicated with that server in the past and what the server's public key was back then. If the key changed since the last connection, the connection must be aborted as a MITM attack is likely taking place.

It was discovered that Cargo never implemented such checks, and performed no validation on the server's public key, leaving Cargo users vulnerable to MITM attacks.

## Affected Versions

All Rust versions containing Cargo before 1.66.1 are vulnerable (prior to 0.67.1 for the crates.io package).

Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH.

## Mitigations

We will be releasing Rust 1.66.1 today, 2023-01-10, changing Cargo to check the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible.

Pat…

gsd-2022-46176

msrc_CVE-2022-46176 — Cargo did not verify SSH host keys

msrc_CVE-2022-46176

OESA-2025-1236 — rust security update

Affected: openEuler:22.03-LTS-SP4: rust

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator. Security Fix(es):

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the sour…

openSUSE-SU-2024:12607-1 — cargo1.65-1.65.0-4.1 on GA media

cargo1.65-1.65.0-4.1 on GA media

UBUNTU-CVE-2022-46176

Affected: Ubuntu:Pro:16.04:LTS: cargo, Ubuntu:Pro:18.04:LTS: cargo, Ubuntu:20.04:LTS: cargo, Ubuntu:22.04:LTS: cargo, Ubuntu:Pro:22.04:LTS: rust-cargo