Most recent entries from all

ALSA-2023:4634 — Important: rust security update

Affected: AlmaLinux:9: cargo, AlmaLinux:9: clippy, AlmaLinux:9: rust, AlmaLinux:9: rust-analysis, AlmaLinux:9: rust-analyzer, AlmaLinux:9: rust-debugger-common, AlmaLinux:9: rust-doc, AlmaLinux:9: rust-gdb, AlmaLinux:9: rust-lldb, AlmaLinux:9: rust-src and 5 more

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

Security Fix(es):

* rust-cargo: cargo does not respect the umask when extracting dependencies (CVE-2023-38497)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05823

Withdrawn: BELL-CVE-2023-38497 — CVE-2023-38497 does not affect BellSoft software

Withdrawn by the publisher.

Withdrawn: CLEANSTART-2026-QJ53684 — Security fixes in rust 1.71.1-r0

Withdrawn by the publisher.

Affected: CleanStart: rust

Package rust version 1.71.1-r0 fixes 1 vulnerabilities: CVE-2023-38497

EUVD-2026-216657

fkie_cve-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

GHSA-j3xp-wfr4-hx87 — Cargo not respecting umask when extracting crate archives

Affected: crates.io: cargo

The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user.

This vulnerability has been assigned CVE-2023-38497.

## Overview

In UNIX-like systems, each file has three sets of permissions: for the user owning the file, for the group owning the file, and for all other local users. The "[umask][1]" is configured on most systems to limit those permissions during file creation, removing dangerous ones. For example, the default umask on macOS and most Linux distributions only allow the user owning a file to write to it, preventing the group owning it or other local users from doing the same.

When a dependency is downloaded by Cargo, its source code has to be extracted on disk to allow the Rust compiler to read as part of the build. To improve performance, this extraction only happens the first time a dependency is used, caching the pre-extracted files for future invocations.

Unfortunately, it was discovered that Cargo did not respect the umask during extraction, and propagated the permissions stored in the crate archive as-is. If an archive contained files writeable by any user on the system (and the system configuration didn't prevent writes through other security measures), another local user on the system could replace o…

gsd-2023-38497

msrc_CVE-2023-38497 — Cargo not respecting umask when extracting crate archives

msrc_CVE-2023-38497

OESA-2025-1236 — rust security update

Affected: openEuler:22.03-LTS-SP4: rust

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator. Security Fix(es):

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible. (CVE-2022-46176)

openSUSE-SU-2024:13101-1 — cargo1.71-1.71.1-1.1 on GA media

cargo1.71-1.71.1-1.1 on GA media

RHSA-2023:4651 — Red Hat Security Advisory: rust-toolset-1.66-rust security update

rust-cargo: cargo does not respect the umask when extracting dependencies

UBUNTU-CVE-2023-38497

Affected: Ubuntu:Pro:16.04:LTS: cargo, Ubuntu:Pro:18.04:LTS: cargo, Ubuntu:Pro:20.04:LTS: cargo, Ubuntu:Pro:22.04:LTS: cargo, Ubuntu:Pro:22.04:LTS: rust-cargo, Ubuntu:24.04:LTS: rust-cargo, Ubuntu:24.04:LTS: rustc

WID-SEC-W-2023-2062 — Red Hat Enterprise Linux (Rust): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Die…

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.