Skip to content
OpenAdvisories
High USN-6275-1 1 CVE

cargo, rust-cargo vulnerability

Published Aug 3, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Addison Crump discovered that Cargo incorrectly set file permissions
on UNIX-like systems when extracting crate archives. If the crate would
contain files writable by any user, a local attacker could possibly use
this issue to execute code as another user.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS cargo 0.47.0-1~exp1ubuntu1~16.04.1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS cargo 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS cargo 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS cargo 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS rust-cargo 0.57.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.8
    CVE-2023-38497 Public exploit

    Cargo not respecting umask when extracting crate archives

    Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…

    rust-lang cargo rust rustc Debian Ubuntu Azure Linux Alpine crates.io

References

  • report
    https://ubuntu.com/security/CVE-2023-38497