Cargo vulnerability

2023-08-0300:00:00

ubuntu.com

cargo vulnerability

ubuntu 22.04 lts

ubuntu 20.04 lts

ubuntu 18.04 esm

ubuntu 16.04 esm

rust package manager

openssl

file permissions

code execution

unix

7.9 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Releases

Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM

Packages

cargo - Rust package manager
rust-cargo - Rust package manager - feature “openssl”

Details

Addison Crump discovered that Cargo incorrectly set file permissions
on UNIX-like systems when extracting crate archives. If the crate would
contain files writable by any user, a local attacker could possibly use
this issue to execute code as another user.

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchcargo< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1UNKNOWN
Ubuntu22.04noarchcargo< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2UNKNOWN
Ubuntu22.04noarchcargo-doc< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2UNKNOWN
Ubuntu22.04noarchlibrust-cargo+openssl-dev< 0.57.0-1ubuntu0.1~esm1UNKNOWN
Ubuntu22.04noarchlibrust-cargo+openssl-dev< 0.57.0-1UNKNOWN
Ubuntu22.04noarchlibrust-cargo-dev< 0.57.0-1UNKNOWN
Ubuntu22.04noarchlibrust-cargo-dev< 0.57.0-1ubuntu0.1~esm1UNKNOWN
Ubuntu20.04noarchcargo< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1UNKNOWN
Ubuntu20.04noarchcargo< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2UNKNOWN
Ubuntu20.04noarchcargo-doc< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	22.04	noarch	cargo	< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1	UNKNOWN
Ubuntu	22.04	noarch	cargo	< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2	UNKNOWN
Ubuntu	22.04	noarch	cargo-doc	< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2	UNKNOWN
Ubuntu	22.04	noarch	librust-cargo+openssl-dev	< 0.57.0-1ubuntu0.1~esm1	UNKNOWN
Ubuntu	22.04	noarch	librust-cargo+openssl-dev	< 0.57.0-1	UNKNOWN
Ubuntu	22.04	noarch	librust-cargo-dev	< 0.57.0-1	UNKNOWN
Ubuntu	22.04	noarch	librust-cargo-dev	< 0.57.0-1ubuntu0.1~esm1	UNKNOWN
Ubuntu	20.04	noarch	cargo	< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1	UNKNOWN
Ubuntu	20.04	noarch	cargo	< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2	UNKNOWN
Ubuntu	20.04	noarch	cargo-doc	< 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2	UNKNOWN