Skip to content
OpenAdvisories
High RHSA-2023:4634 1 CVE

Red Hat Security Advisory: rust security update

Published Sep 14, 2024 · Updated Feb 26, 2026

Ecosystem: Red Hat

Fixed packages 21

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream cargo 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream cargo-debuginfo 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream clippy 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream clippy-debuginfo 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-analysis 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-analyzer 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-analyzer-debuginfo 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-debugger-common 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-debuginfo 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-debugsource 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-doc 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-gdb 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-lldb 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-src 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-std-static 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-std-static-wasm32-unknown-unknown 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-std-static-wasm32-wasi 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rust-toolset 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rustfmt 0:1.66.1-2.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream rustfmt-debuginfo 0:1.66.1-2.el9_2

Vulnerabilities 1

  • High 7.8
    CVE-2023-38497 Public exploit

    Cargo not respecting umask when extracting crate archives

    Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…

    rust-lang cargo rust rustc Debian Ubuntu Azure Linux Alpine crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2228038
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4634.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-38497
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-38497
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-38497
  • article
    https://www.openwall.com/lists/oss-security/2023/08/03/2