ALT-PU-2018-2345

Высокий

ALT-PU-2018-2345: package rust update to version 1.29.0-alt1

Источник

errata.altlinux.org

Дата публикации

19.09.2018

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades rust to version 1.29.0-alt1.

Устраненные уязвимости4

BDU:2020-01729

Средний 6.3

Дата публикации: 23.04.2020

Уязвимость плагина rustdoc языка программирования Rust, позволяющая нарушителю выполнить произвольный код

CVSS 3.1

Средний 6.3

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

CVSS 2.0

Средний 6.8

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

BDU:2020-01729 https://bdu.fstec.ru/vul/2020-01729

Ссылки2

ALT-PU-2018-2345 https://errata.altlinux.org/ALT-PU-2018-2345

GHSA-9f3p-wvj7-q82x

https://github.com/advisories/GHSA-9f3p-wvj7-q82x

Связанные уязвимости

CVE-2018-1000622

CVSS3: 7.8

ubuntu

больше 8 лет назад

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.