Lucene search
RedHatRHSA-2024:3428HistoryMay 28, 2024 - 1:07 p.m.
(RHSA-2024:3428) Important: rust-toolset:rhel8 security update
2024-05-2813:07:54
CWE-276
access.redhat.com
17
rust toolset
security update
cargo
dependencies
cve-2023-38497
unix
CVSS3
7.9
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
AI Score
6.4
Confidence
Low
EPSS
0
Percentile
5.1%
Rust Toolset provides the Rust programming language compiler rustc, the cargo
build tool and dependency manager, and required libraries.
Security Fix(es):
- rust-cargo: cargo does not respect the umask when extracting dependencies
(CVE-2023-38497)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected configurations
Node
redhatrust-toolset-1.66-rust-0Range≤1.66.1-2.el7_9
ORredhatrust-toolsetRange≤rhel8-8080020230807230209.0a78da64
ORredhatrust-toolsetRange≤rhel8-8060020240312174911.aeeed864
ORredhatrustRange≤1.66.1-2.el9_2
ORredhatrust-0Range≤1.58.1-1.el9_0.1
redhatenterprise_linuxMatch8
ORredhatenterprise_linuxMatch9
| Vendor | Product | Version | CPE |
|---|---|---|---|
| redhat | rust-toolset-1.66-rust-0 | * | cpe:2.3:a:redhat:rust-toolset-1.66-rust-0:*:*:*:*:*:*:*:* |
| redhat | rust-toolset | * | cpe:2.3:a:redhat:rust-toolset:*:*:*:*:*:*:*:* |
| redhat | rust | * | cpe:2.3:a:redhat:rust:*:*:*:*:*:*:*:* |
| redhat | rust-0 | * | cpe:2.3:a:redhat:rust-0:*:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 8 | cpe:2.3:o:redhat:enterprise_linux:8:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 9 | cpe:2.3:o:redhat:enterprise_linux:9:*:*:*:*:*:*:* |
Related
amazon
amazon
Important: rust
2023-08-31 22:28:00
openvas
openvas
Fedora: Security Advisory for rust (FEDORA-2023-4824704a61)
2023-08-17 00:00:00
Ubuntu: Security Advisory (USN-6275-1)
2023-08-04 00:00:00
Fedora: Security Advisory for rust (FEDORA-2023-6f2c7aa713)
2023-08-10 00:00:00
nessus
nessus
Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2023-323)
2023-09-08 00:00:00
Oracle Linux 8 : rust-toolset:ol8 (ELSA-2023-4635)
2023-08-28 00:00:00
Fedora 38 : rust (2023-6f2c7aa713)
2023-08-10 00:00:00
veracode
veracode
Directory Traversal
2023-08-07 05:59:23
cbl_mariner
cbl_mariner
CVE-2023-38497 affecting package rust for versions less than 1.72.0-2
2023-10-11 01:41:59
osv
osv
Red Hat Security Advisory: rust-toolset:rhel8 security update
2024-09-14 01:41:50
Red Hat Security Advisory: rust-toolset:rhel8 security update
2024-09-14 01:54:53
Important: rust-toolset:rhel8 security update
2023-08-14 00:00:00
hackerone
hackerone
redhat
redhat
(RHSA-2024:3418) Important: rust security update
2024-05-28 13:04:17
(RHSA-2023:4634) Important: rust security update
2023-08-14 13:42:34
(RHSA-2023:4651) Important: rust-toolset-1.66-rust security update
2023-08-15 00:05:25
redos
redos
ROS-20240729-09
2024-07-29 00:00:00
ubuntucve
ubuntucve
CVE-2023-38497
2023-08-03 00:00:00
rocky
rocky
rust-toolset:rhel8 security update
2023-08-24 04:21:04
rust security update
2023-08-24 04:21:28
almalinux
almalinux
Important: rust-toolset:rhel8 security update
2023-08-14 00:00:00
Important: rust security update
2023-08-14 00:00:00
oraclelinux
oraclelinux
rust-toolset:ol8 security update
2023-08-28 00:00:00
rust security update
2023-08-25 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: rust-1.71.1-1.fc37
2023-08-17 00:34:26
[SECURITY] Fedora 38 Update: rust-1.71.1-1.fc38
2023-08-10 00:43:17
github
github
Cargo not respecting umask when extracting crate archives
2023-08-03 16:30:52
ubuntu
ubuntu
Cargo vulnerability
2023-08-03 00:00:00
debiancve
debiancve
CVE-2023-38497
2023-08-04 16:15:10
vulnrichment
vulnrichment
CVE-2023-38497 Cargo not respecting umask when extracting crate archives
2023-08-04 15:51:44
cve
cve
CVE-2023-38497
2023-08-04 16:15:10
prion
prion
Code injection
2023-08-04 16:15:00
redhatcve
redhatcve
CVE-2023-38497
2023-08-04 11:23:22
cvelist
cvelist
CVE-2023-38497 Cargo not respecting umask when extracting crate archives
2023-08-04 15:51:44
alpinelinux
alpinelinux
CVE-2023-38497
2023-08-04 16:15:10
githubexploit
githubexploit
nvd
nvd
CVE-2023-38497
2023-08-04 16:15:10
gentoo
gentoo
Rust: Multiple Vulnerabilities
2024-09-22 00:00:00
CVSS3
7.9
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
AI Score
6.4
Confidence
Low
EPSS
0
Percentile
5.1%
Related for RHSA-2024:3428