Headline

Red Hat Security Advisory 2023-4635-01

Red Hat Security Advisory 2023-4635-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: rust-toolset:rhel8 security update
Advisory ID: RHSA-2023:4635-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4635
Issue date: 2023-08-14
CVE Names: CVE-2023-38497
=====================================================================

Summary:

An update for the rust-toolset:rhel8 module is now available for Red Hat
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Description:

Rust Toolset provides the Rust programming language compiler rustc, the
cargo build tool and dependency manager, and required libraries.

Security Fix(es):

rust-cargo: cargo does not respect the umask when extracting dependencies
(CVE-2023-38497)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

2228038 - CVE-2023-38497 rust-cargo: cargo does not respect the umask when extracting dependencies

Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.src.rpm

aarch64:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm

noarch:
rust-debugger-common-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
rust-gdb-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
rust-lldb-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
rust-src-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm

ppc64le:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm

s390x:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm

x86_64:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2023-38497
https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIcBAEBCAAGBQJk2ozbAAoJENzjgjWX9erEVpEP/0hiApFigMqLiLBLd5B6ktf4
ruTEx7AXpA9drO1BmkQEwJlp0Nlr5zbOzacV62rPc7AuxQh5EKpjKRRvUzew29Ae
j9tkEfpSPm1/qeY5cHtumaVDapdxY0zhe771sL0F99MxucpQkp3Okk+AK8gLC5nf
0lFmBmnWCcGa6ODIez6JJPx/ghzREYzeS0Gg9FlFDBm0pP3LXoVGOZpr5R6RCTWt
6BYyaYWWwYWU8Yu2P0p5cMO4X6sM5wPTUsmQyXVBcjFAsT9vUGMiY0v0JyeXHb2c
vrZekj6yXHVfmG3KlPbqRwosBkKY1IqWJXkiz5pKrZNNoy21uIqDjdU7ERLsGxMn
ZgozMGlkbBNch3Fx/EIhNyp+aY7QKipnTfCPTvPQ0ZC01T2lZkmjNe0k7OdqJz8g
ACLq4xz7SLhdH+xHPtSs7ARg6W9bcGvLQCrgXgJoVTf/L3LWbQ7AAFa3orSwZ8QX
Me8MadVJTKFZ6pq+MaOqKzqLnmkvpl+KqGYWpLKIC4hXKP87QNd870dNMBNyVgjG
CtoJxwl8FFwJba5GUc9EWXo+eSpv2kvcTEcTMtzJSiprdlFaFpwWC2OS6Tju5UNq
gfmcNGhgXoX8Z4QOH38gsHZTvg9BBYSIPG/XRKi2AGac2TfpHOwLG/AUW4oyUSvg
WzuJxXfhZZXj27mWAGnq
=ZDuF
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2024-3428-03

Red Hat Security Advisory 2024-3428-03 - An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

5 months ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

Red Hat Security Advisory 2024-3418-03

Red Hat Security Advisory 2024-3418-03 - An update for rust is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.

5 months ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js

Red Hat Security Advisory 2023-4651-01

Red Hat Security Advisory 2023-4651-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

1 year ago

Packet Storm

Open in Source

#xss #vulnerability #linux #red_hat

Red Hat Security Advisory 2023-4634-01

Red Hat Security Advisory 2023-4634-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

1 year ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat

RHSA-2023:4651: Red Hat Security Advisory: rust-toolset-1.66-rust security update

An update for rust-toolset-1.66-rust is now available for Red Hat Developer Tools. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38497: A flaw was found in the rust-cargo package. Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the extracted source code, potentially exec...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #kubernetes #aws #ibm

CVE-2023-38497: Fix CVE-2023-38497 for master by pietroalbini · Pull Request #12443 · rust-lang/cargo

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

1 year ago

CVE

Open in Source

#git

Ubuntu Security Notice USN-6275-1

Ubuntu Security Notice 6275-1 - Addison Crump discovered that Cargo incorrectly set file permissions on UNIX-like systems when extracting crate archives. If the crate would contain files writable by any user, a local attacker could possibly use this issue to execute code as another user.

1 year ago

Packet Storm

Open in Source

#vulnerability #ubuntu #git #ssl

GHSA-j3xp-wfr4-hx87: Cargo not respecting umask when extracting crate archives

The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. This vulnerability has been assigned CVE-2023-38497. ## Overview In UNIX-like systems, each file has three sets of permissions: for the user owning the file, for the group owning the file, and for all other local users. The "[umask][1]" is configured on most systems to limit those permissions during file creation, removing dangerous ones. For example, the default umask on macOS and most Linux distributions only allow the user owning a file to write to it, preventing the group owning it or other local users from doing the same. When a dependency is downloaded by Cargo, its source code has to be extracted on disk to allow the Rust compiler to read as part of the build. To ...

1 year ago

ghsa

Open in Source

#vulnerability #mac #windows #linux #git