Summary
Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.
Security Fix(es):
* rust-cargo: cargo does not respect the umask when extracting dependencies (CVE-2023-38497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | cargo | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | clippy | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-analysis | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-analyzer | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-debugger-common | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-doc | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-gdb | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-lldb | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-src | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-std-static | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-std-static-wasm32-unknown-unknown | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-std-static-wasm32-wasi | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rust-toolset | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
| AlmaLinux · 8 | rustfmt | 1.66.1-2.module_el8.8.0+3604+b9bee1fc |
Vulnerabilities 1
-
High 7.8CVE-2023-38497 Public exploit
Cargo not respecting umask when extracting crate archives
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…