CVE-2022-46176

Cargo is a Rust package manager. The Rust Security Response WG was notified
that Cargo did not perform SSH host key verification when cloning indexes
and dependencies via SSH. An attacker could exploit this to perform
man-in-the-middle (MITM) attacks. This vulnerability has been assigned
CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are
vulnerable. Note that even if you don’t explicitly use SSH for alternate
registry indexes or crate dependencies, you might be affected by this
vulnerability if you have configured git to replace HTTPS connections to
GitHub with SSH (through git’s [url.<base>.insteadOf][1] setting), as
that’d cause you to clone the crates.io index through SSH. Rust 1.66.1 will
ensure Cargo checks the SSH host key and abort the connection if the
server’s public key is not already trusted. We recommend everyone to
upgrade as soon as possible.