Skip to content
OpenAdvisories
Medium ALAS2023-2025-1092 1 CVE

Moderate: rust security update (Amazon Linux 2023)

Published Jul 21, 2025 · Updated Aug 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53605: The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Fixed packages 21

ReleasePackageFixed in
Amazon Linux · 2023 cargo 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 cargo-debuginfo 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 clippy 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 clippy-debuginfo 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-analyzer 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-analyzer-debuginfo 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-debugger-common 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-debuginfo 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-debugsource 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-doc 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-gdb 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-lldb 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-src 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-std-static 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-std-static-wasm32-unknown-unknown 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-std-static-wasm32-wasip1 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-toolset 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rust-toolset-srpm-macros 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rustfmt 0:1.88.0-1.amzn2023.0.2
Amazon Linux · 2023 rustfmt-debuginfo 0:1.88.0-1.amzn2023.0.2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-53605.html