Skip to content
OpenAdvisories
High RHSA-2024:3428 1 CVE

Red Hat Security Advisory: rust-toolset:rhel8 security update

Published Sep 14, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 22

ReleasePackageFixed in
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream cargo 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream cargo-debuginfo 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream cargo-doc 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream clippy 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream clippy-debuginfo 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rls 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rls-debuginfo 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-analysis 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-debugger-common 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-debuginfo 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-debugsource 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-doc 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-gdb 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-lldb 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-src 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-std-static 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-std-static-wasm32-unknown-unknown 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-std-static-wasm32-wasi 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rust-toolset 0:1.58.1-1.module+el8.6.0+14021+586eff1a
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rustfmt 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1
Red Hat · RHEL 8.6 EUS rhel_eus:8.6::appstream rustfmt-debuginfo 0:1.58.1-1.module+el8.6.0+21522+a4bc17c1.1

Vulnerabilities 1

  • High 7.8
    CVE-2023-38497 Public exploit

    Cargo not respecting umask when extracting crate archives

    Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…

    rust-lang cargo rust rustc Debian Ubuntu Azure Linux Alpine crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2228038
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3428.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-38497
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-38497
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-38497
  • article
    https://www.openwall.com/lists/oss-security/2023/08/03/2