Skip to content
OpenAdvisories
High RHSA-2023:4635 1 CVE

Red Hat Security Advisory: rust-toolset:rhel8 security update

Published Sep 14, 2024 · Updated Feb 26, 2026

Ecosystem: Red Hat

Fixed packages 21

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream cargo 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream cargo-debuginfo 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream clippy 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream clippy-debuginfo 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-analysis 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-analyzer 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-analyzer-debuginfo 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-debugger-common 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-debuginfo 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-debugsource 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-doc 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-gdb 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-lldb 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-src 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-std-static 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-std-static-wasm32-unknown-unknown 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-std-static-wasm32-wasi 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rust-toolset 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rustfmt 0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Red Hat · RHEL 8 enterprise_linux:8::appstream rustfmt-debuginfo 0:1.66.1-2.module+el8.8.0+19613+f0bba33b

Vulnerabilities 1

  • High 7.8
    CVE-2023-38497 Public exploit

    Cargo not respecting umask when extracting crate archives

    Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…

    rust-lang cargo rust rustc Debian Ubuntu Azure Linux Alpine crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2228038
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4635.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-38497
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-38497
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-38497
  • article
    https://www.openwall.com/lists/oss-security/2023/08/03/2