Headline

Red Hat Security Advisory 2023-4651-01

Red Hat Security Advisory 2023-4651-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

1 year ago

Packet Storm

Open in Source

#xss #vulnerability #linux #red_hat

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: rust-toolset-1.66-rust security update
Advisory ID: RHSA-2023:4651-01
Product: Red Hat Developer Tools
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4651
Issue date: 2023-08-15
CVE Names: CVE-2023-38497
=====================================================================

Summary:

An update for rust-toolset-1.66-rust is now available for Red Hat Developer
Tools.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Description:

Rust Toolset provides the Rust programming language compiler rustc, the
cargo build tool and dependency manager, and required libraries.

Security Fix(es):

rust-cargo: cargo does not respect the umask when extracting dependencies
(CVE-2023-38497)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

2228038 - CVE-2023-38497 rust-cargo: cargo does not respect the umask when extracting dependencies

Package List:

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7):

Source:
rust-toolset-1.66-rust-1.66.1-2.el7_9.src.rpm

noarch:
rust-toolset-1.66-rust-debugger-common-1.66.1-2.el7_9.noarch.rpm
rust-toolset-1.66-rust-gdb-1.66.1-2.el7_9.noarch.rpm
rust-toolset-1.66-rust-lldb-1.66.1-2.el7_9.noarch.rpm
rust-toolset-1.66-rust-src-1.66.1-2.el7_9.noarch.rpm

ppc64:
rust-toolset-1.66-cargo-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-clippy-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rust-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rust-analysis-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rust-analyzer-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rust-debuginfo-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rust-doc-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rust-std-static-1.66.1-2.el7_9.ppc64.rpm
rust-toolset-1.66-rustfmt-1.66.1-2.el7_9.ppc64.rpm

ppc64le:
rust-toolset-1.66-cargo-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-clippy-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rust-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rust-analysis-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rust-analyzer-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rust-debuginfo-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rust-doc-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rust-std-static-1.66.1-2.el7_9.ppc64le.rpm
rust-toolset-1.66-rustfmt-1.66.1-2.el7_9.ppc64le.rpm

s390x:
rust-toolset-1.66-cargo-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-clippy-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rust-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rust-analysis-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rust-analyzer-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rust-debuginfo-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rust-doc-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rust-std-static-1.66.1-2.el7_9.s390x.rpm
rust-toolset-1.66-rustfmt-1.66.1-2.el7_9.s390x.rpm

x86_64:
rust-toolset-1.66-cargo-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-clippy-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rust-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rust-analysis-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rust-analyzer-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rust-debuginfo-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rust-doc-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rust-std-static-1.66.1-2.el7_9.x86_64.rpm
rust-toolset-1.66-rustfmt-1.66.1-2.el7_9.x86_64.rpm

Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7):

Source:
rust-toolset-1.66-rust-1.66.1-2.el7_9.src.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2023-38497
https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIcBAEBCAAGBQJk2uDAAAoJENzjgjWX9erEaSgP/2gn/rFD6+e48xJoIeXSydES
JJQkdPZPocfZin6bb62eJAOV8GcsHN45m0FxSSX6NRQb9Av4R4ksCPo8M2ftRvRO
G4xy6I/ym5TSGvyWFkRxdnD1thYWyDnC83D0dnZEii/d2+7wjISreM5PKURJ/zYx
j8GSZia8yT1znUEJd25xhPp/NNf6O8l4q67InXWEKULKQtgkJevM87wDKoSMD7Tg
vUsTIK7941KScUw4QrfkHA6zu0aLGr3HLot57wUI+1whWC730SEDt8HGZkMAe8y1
FBpxqBRFULbEk6DRwvvbmk2wFROXDKBzcgJB3tUUCynVRLLglEf2U/Sp8kjPu9Ij
h7WH2Urr+gRj+iI3HWtE/M1NIUF0HDCT4PqwYCiskZ2jORpGO+4OTy4lyf3GBSed
8zhfjfASfQBGMF9JCYKbGzH1THFqVwnNwndvKdR/DZcKi6aomcUf/X5sRm8zLNDt
jGw2o/BKibScrmZXM8dIigGxPX02k259rDfVJrWl6TIqAtImKxsyTO2M1qDU0kWh
4Mbsv4T5WlBn4Tp9RBdD44uUdL8ZYMXtn6msL2RUTwtcSm/tGL1OE6NkA0I4LVde
Zr9NKOe13vH6BU5oJgU4jLdKptYtylEWHJ2uAsgA1c0+58frnbFah+yjEU24VL88
bS3EcqdJYl2QIGy5nyDM
=0C7F
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2024-3428-03

Red Hat Security Advisory 2024-3428-03 - An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

7 months ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

Red Hat Security Advisory 2024-3418-03

Red Hat Security Advisory 2024-3418-03 - An update for rust is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.

7 months ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

Red Hat Security Advisory 2023-4635-01

Red Hat Security Advisory 2023-4635-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

Red Hat Security Advisory 2023-4634-01

Red Hat Security Advisory 2023-4634-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat

RHSA-2023:4651: Red Hat Security Advisory: rust-toolset-1.66-rust security update

An update for rust-toolset-1.66-rust is now available for Red Hat Developer Tools. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38497: A flaw was found in the rust-cargo package. Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the extracted source code, potentially exec...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #kubernetes #aws #ibm

CVE-2023-38497: Fix CVE-2023-38497 for master by pietroalbini · Pull Request #12443 · rust-lang/cargo

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

1 year ago

CVE

Open in Source

#git

Ubuntu Security Notice USN-6275-1

Ubuntu Security Notice 6275-1 - Addison Crump discovered that Cargo incorrectly set file permissions on UNIX-like systems when extracting crate archives. If the crate would contain files writable by any user, a local attacker could possibly use this issue to execute code as another user.

1 year ago

Packet Storm

Open in Source

#vulnerability #ubuntu #git #ssl

GHSA-j3xp-wfr4-hx87: Cargo not respecting umask when extracting crate archives

The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. This vulnerability has been assigned CVE-2023-38497. ## Overview In UNIX-like systems, each file has three sets of permissions: for the user owning the file, for the group owning the file, and for all other local users. The "[umask][1]" is configured on most systems to limit those permissions during file creation, removing dangerous ones. For example, the default umask on macOS and most Linux distributions only allow the user owning a file to write to it, preventing the group owning it or other local users from doing the same. When a dependency is downloaded by Cargo, its source code has to be extracted on disk to allow the Rust compiler to read as part of the build. To ...

1 year ago

ghsa

Open in Source

#vulnerability #mac #windows #linux #git