Skip to content
OpenAdvisories

Package · Ubuntu

rust-cargo

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.8
    CVE-2023-38497 Public exploit

    Cargo not respecting umask when extracting crate archives

    Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…

    rust-lang cargo rustc chromium-rust Debian Ubuntu Alpine crates.io
  • Medium 5.3
    CVE-2022-46176

    Cargo did not verify SSH host keys

    Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vu…

    rust-lang cargo rust chromium-rust Debian Ubuntu Alpine crates.io