Описание
Security update for rustup
This update for rustup fixes the following issues
Security issues:
- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
- CVE-2026-41676: openssl:
Deriver:deriveandPkeyCtxRef:derivecan overflow short buffers on OpenSSL 1.1.1 (bsc#1270186). - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
- CVE-2026-45784: openssl: out-of-bounds write in
CipherCtxRef::cipher_update_inplacefor AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989). - rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).
Non security issue:
- devel:languages:rust/rustup: Missing symlink for rust-analyzer (bsc#1203257).
Changes for rustup:
- Completely drop openssl to prevent future security issues
Update to version 1.28.2~0:
- Deprecate native-tls as well
- Enable HTTP/2 support for reqwest download backend
- Emit tracing events from log facade calls
- download: show Debug representation for errors
- Avoid repeated globals in tracing events
- Log original download errors immediately
- feat(cli/rustup-mode): add aliases to
rustup component remove - Switch flate2 to use the zlib-rs backend
- Hardlink proxies if symlinks aren't reachable
- Add powerpc64le-unknown-linux-musl support
- Add toolchain_name to not installed bail msg
- Warn about using curl
- Drop workspace indirection
- Fold download crate back into rustup
- download: merge integration test files
- chore(deps): lock file maintenance
- Test CARGO environment replacement
- Update CARGO env var if it is a rustup proxy
- Tweak toolchain subcommand help text
- Move toolchain and default commands first
- show toolchain paths in rustup show -v output
- refactor(cli/self-update): save allocations in
Nu::rcfiles() - fix(cli/self-update)!: stop appending to
env.nudue to deprecation - fix(cli/self-update): consider Windows paths in Nushell suggestions
- refactor(cli/self-update): use
path addinenv.nutemplate - fix(cli/self-update): use interpolated string in
env.nutemplate - Upgrade dependencies
- docs(user-guide/environment-variables): document
RUSTUP_VERSION - feat(rustup-init/sh): allow setting
RUSTUP_VERSIONduring installation - feat(cli/self-update): allow setting
RUSTUP_VERSIONfor arbitrary downgrades - feat(test/clitools): add
Config::expect_ok_ex_env() - fix(errors)!: improve error messages for
RustupError::ToolchainNotInstalled - Add set auto-install disable
- Use
cursor: pointerfor copy button on website - fix(dist): refine suggestions about missing targets
- Append Windows bin directory to PATH by default
- Remove validation for custom toolchains when reading rust-toolchain.toml
- document RUSTUP_AUTO_INSTALL
- Fix build script
cargoinstructions
Update to version 1.28.1~0:
- dist(rustup-init/sh): update commit shasum
- Update changelog for 1.28.1
- fix!(config): re-enable implicit toolchain installation in
Cfg::local_toolchain()with optional opt-out - refactor(test/clitools): extract
Config::expect_err_env() - Use relative symlinks when possible
- docs: update CHANGELOG for v1.28.1 release
- fix!(config): re-enable active toolchain installation in
Cfg::find_active_toolchain()with optional opt-out - config: make Config::find_active_toolchain() async
- Use terse output for rustup show active-toolchain
- Use read_timeout for reqwest instead of timeout
- test: turn set_current_dist_date() into a Config method
- test: privatize clitools module
- test: remove function wrappers for cmd() and env()
- test: privatize mock module
- test: move create_mock_dist_server() to Scenario::write_to()
- test: move Release into dist
- test: turn channel builders into constructors
- test: move mock channel builders into dist
- test: move arch consts into top-level module
- test: turn build_*_installer() functions into constructors
- test: move installer builders into mock module
- test: privatize items in clitools
- test: keep Config impl close to type definition
- test: privatize dist module
- test: privatize items in test::dist
- test: inline short module topical_doc_data
- Remove level of nesting in test module
- Tweak SanitizedOutput style
- docs: update
CHANGELOGfor v1.28.0 release - Have mocked cargo better adhere to cargo conventions
- Do not append
EXE_SUFFIXinConfig::cmd - Add
TryFrom<Output>forSanitizedOutput - refactor(test): replace
(before|after)_test_async()withTestProcess::_telemetry_guard - style(rustup-init): reorganize imports
- refactor(log): introduce
GlobalTelemetryGuard - refactor(process): rename
TestProcess::_guardto_tracing_guard - chore(deps): update opentelemetry
- fix(deps): update rust crate windows-registry to 0.5.0
- refactor: improve binary suffix stripping
- build: bump the codebase Language Edition to 2024
- style(cli/job): fix
unsafe-op-in-unsafe-fn - style(cli/log): use precise capturing when necessary
- chore: use unsafe versions of
(add|remove)_var() - style: remove redundant
refkeywords - style: partially migrate away from
if-let - style: format sources with the 2024 Style Edition
- chore: fix new
clippywarnings - fix(deps): update rust crate pulldown-cmark to 0.13
- feat(rustup-init/sh): add env var to print arch detection result
- refactor(component): reduce allocations in
ComponentPart::encode() - refactor(component)!: extract
ComponentPartKind - style(component): reduce right drift in
ComponentPart::decode() - refactor(component)!: turn
ComponentPart's fields into named ones - fix(dist/prefix): normalize path separators in
REL_MANIFEST_DIR - fix(component): normalize path separators during
ComponentPart::(en|de)code() - Upgrade to rand 0.9
- fix(ci/doc): fix typo in renovate
datasource - ci(doc): make
renovatebotbump lockedmdbook - ci(doc): pin
mdbookto0.4.43 - ci(schedule): run cron tasks more times per week
- ci(schedule): promote to use the
stablejob list - ci(doc): fix stable build of
user-guide - ci(linux): enable the full test suite for
aarch64-unknown-linux-gnu - ci(linux): use public ARM64 Linux runners
- ci(deploy-docs): merge with
test-docs - ci(deploy-docs): enable on PR without uploads
- ci(deploy-docs): build one book per workflow step
- ci(deploy-docs): install
mdbookwithinstall-action - Change installation of dependencies for Aarch64 Dockerfile
- Run Aarch64 jobs on PRs
- Use ARM based runners for ARM CI targets
- style: fix
clippywarnings - docs(user-guide/components): add deprecation notice for
wasm32-wasi - Update Windows dependencies
- feat(cli/rustup-mode)!: simplify error message for
rustup show active-toolchain - fix(cli/rustup-mode): make
rustup show active-toolchainexit with1when none is active - fix(cli/rustup-mode): make
rustup defaultexit with1when there's no default - fix(cli/rustup-mode)!: change
rustup doc --error_codesto--error-codes - fix(deps): update rust crate itertools to 0.14
- fix(cli): align
rustup show's--verbosebehavior withrustup show active-toolchain - feat(cli): show the toolchain path with
rustup show active-toolchain --verbose - feat(test): accept more than one args in
for_host*!() - fix(ci): fix installation of
cargo-all-features - docs(user-guide/installation): update 'General tips'
- move deps around
- fix(deps): update rust crate rustls-platform-verifier to 0.5
- fix(rustup-init/sh): don't emit 'unknown macOS major version' for macOS v11+
- refactor(rustup-init/sh): extract
$_os_major - refactor(rustup-init/sh): extract
$_os_version - ci(linux): move
bindgen-cliinstallation intorun.bash - ci(stable): enable
loongarch64-unknown-linux-muslbuilds - ci(linux): disable
reqwest-rustls-tlsfor unsupported platforms - ci(linux): configure
gcc-multilibandlibclangfor some *nix builds - chore(deps): bump
aws-lc-rsandaws-lc-sys - download: clean up TLS feature guards
- download: simplify feature guards
- download: attach download functions to Backend type
- download: remove intermediate reqwest-backend feature
- Implement more complete backend selection
- Simplify logic for download backend notification
- docs(dev-guide/tracing): make 'Adding instrumentation' a level-2 title
- ci(windows): don't install
awscliviachoco - test(mock/topical-doc-data): add test cases with both a flag and a topic
- refactor(test/mock): use tuples for
topical_doc_data::TEST_CASES - feat(cli/rustup-mode): allow
rustup docwith both a flag and a topic - refactor(toolchain): allow passing a fragment in
Toolchain::doc_path() - refactor(toolchain): allow absolute paths in
Toolchain::doc_path() - refactor(toolchain): simplify
Toolchain::doc_path() - refactor(cli/rustup-mode): rename
doc_urltodoc_path - refactor(cli/rustup-mode): make
DocPage::path()returnOption<&Path> - refactor(cli/rustup-mode): move
DocPage::name()to a separateimplblock - refactor(cli/topical-doc): clean up some funtions
- refactor(cli/rustup-mode): use early return in
doc() - Update semver-compatible dependencies
- fix: make sure no overflow on small screens
- feat: make the box white
- feat: use the color form the rust website for tags, hr and copy button
- Add the main element and header to setup new layout
- chore: remove the old pitch first
- Apply clippy suggestions
- Append to 1.28.0 changelog
- Bump version, commit and date in rustup-init.sh
- Clean up trailing whitespace in rustup-init.sh
- Add changelog for 1.28.0
- Bump version to 1.28.0
- chore(deps): update remove-dir-all to 1.0
- Add aliases for remove/uninstall/unset commands
- feat: add nushell support
- Upgrade to opentelemetry 0.27
- fix: add missing close body tag
- Upgrade thiserror to 2
- Upgrade to rustls-platform-verifier 0.4
- fix(cli/rustup-mode): remove
.num_args()when.value_delimiter(',')is present - refactor(cli/rustup-mode): remove deprecated
.use_value_delimiter() - chore(config): migrate config .github/renovate.json
- docs: update channel toolchain syntax
- feat(cli/rustup-mode): support more books in
rustup doc - style(cli/rustup-mode): reorder items in
docs_data![] - fix: add powerpc64 and s390x to known target_arch values for tests
- style(utils): put the
moddeclarations below the imports - style: regroup some imports
- refactor(utils): hoist
utils::utilsintoutils - feat(rustup-init): detect and warn about existing
settings.toml - fix: fix typo in
check_existence_of_rustc_or_cargo_in_path() - style: allow using
dbg!()acrossrustup::test - refactor(diskio): replace
eprintln!()withdebug!() - style: enable
clippy::(dbg_macro|todo)across the workspace - style: enable
clippy::print_std(err|out)when applicable - style: introduce workspace-wide lint tables
- build: use
workspace.packageproperties inCargo.toml - fix(config): improve error when overridden active custom toolchain isn't installed
- fix(config): print special error for invalid toolchain name in override file
- Update semver-compatible dependencies, except openssl-src
- style(rustup-init/sh): ignore
shellcheckSC2086 false positives - fix(rustup-init/sh): fix incorrect TLS warning with curl v8.10
- tests: rust-toolchain + profile in settings
- Remove unnecessary methods
- replace
winregdependency - Update remove_dir_all
- refactor(cli/common)!: deny installing a host-incompatible toolchain w/o
--force-non-host - refactor(cli/common)!: take in
toolchain: Stringinwarn_if_host_is_incompatible() - feat(cli/rustup-mode): add
--force-non-hosttorustup default - refactor(config)!: pass the
force_non_hostflag toCfg::ensure_installed() - refactor(cli/rustup-mode): rename
forcedtoforce_non_host - docs(README): Point out where to find nightly/master docs.
- Note that selecting VS lang packs is optional
- Make symlink_or_hardlink_file remove dest
- Try symlinking proxies first
- Apply clippy suggestions from 1.81
- feat(cli/rustup-mode)!: set log level to
INFO/DEBUGon--quiet/--verboseifRUSTUP_LOGis unset - refactor(cli/setup-mode): extract
update_console_logger() - fix(cli/setup-mode): simplify description for
--quiet - feat(cli/setup-mode)!: set log level to
DEBUGon--verboseifRUSTUP_LOGis unset - refactor(common)!: remove
verboseflag in several places - refactor(config): simplify
find_or_install_active_toolchain() - refactor(config)!: return
LocalToolchainNamefromfind_or_install_active_toolchain() - refactor(config): simplify
resolve_toolchain() - refactor(config): simplify
toolchain_from_partial() - chore(triage): allow transferring issues to other org repos
- Allow
rustup docto search for unions - docs(user-guide): add a link to the latest 'Previous components' section
- test(cli_v2): introduce
update_removed_component_toolchain() - feat(dist): add notes for
stableandbetaincomponents_missing_msg() - refactor(dist): inline some const strings in
components_missing_msg() - refactor(dist): extract 'nightly tips' out of the match block in
components_missing_msg() - fix: fix typo in several places
- Upgrade pulldown-cmark to 0.12
- fix(manifest): consider possible renames in
Component::try_new() - ci(macos): install
awsclifrombrew - refactor(config)!: make
toolchain_from_partial()sync - feat(config)!: remove implicit installation from
toolchain_from_partial() - refactor(config)!: make
resolve_toolchain()sync - feat(config)!: remove implicit installation from
resolve_toolchain() - test(cli-rustup): remove
heal_damaged_toolchain() - refactor(config): extract
local_toolchain()fromresolve_local_toolchain() - refactor(config): extract
toolchainvariable fromresolve_local_toolchain() - refactor(config)!: make
resolve_local_toolchain()sync - feat(config)!: remove implicit installation from
resolve_local_toolchain() - refactor(config)!: rename
local_toolchain()toresolve_local_toolchain() - feat(rustup-mode): install the active toolchain by default on
rustup toolchain install - fix(rustup-mode): adjust descriptions for
rustup toolchain uninstall - feat(rustup-mode)!: add
ensure_active_toolchainflag toupdate() - feat(config)!: add
verboseflag tofind_or_install_active_toolchain() - style(config): replace
dist::ProfilewithProfile - style(config): replace
dist::TargetTriplewithTargetTriple - fix(config): call
warn_if_host_is_incompatible()inensure_installed() - refactor(common): use early return in
warn_if_host_is_incompatible() - refactor(rustup-mode): extract
warn_if_host_is_incompatible() - style(common): merge imports
- refactor(distributable)!: avoid unnecessary clones
- refactor(distributable)!: replace
install_if_not_installed()withensure_installed() - feat(config)!: add
verboseflag toensure_installed() - feat(config)!: return
UpdateStatusfromensure_installed() - feat(config)!: use
Cfg::get_profile()for unspecified profile inensure_installed() - chore(config): add
#[tracing::instrument]toensure_installed() - ci(freebsd): fix build failure related to
aws-lc - ci(windows): don't install OpenSSL via
choco - ci(run): remove redundant
ifpredicate - ci(run): use the detected number of test threads
- feat(download/rustls): use
aws-lcinstead ofring - style(taplo): enable
reorder_keysfor*dependenciesinCargo.toml - Upgrade windows-sys to 0.59
- fix: fix unreachable code lints on Android
- docs(dev-guide): remove descriptions of
rustup_macros - docs(dev-guide): update description of
rustup::process - Remove
once_celldependency - docs(dev-guide): add guideline for atomic commits to the developer guide
- fix: fix
clippylints - docs(user-guide): use
brew install rustupinstead ofrustup-init - Bump fs_at to 0.2.1
- chore(deps/renovate): disable
automerge - Upgrade to opentelemetry 0.24
- build(windows): don't link against
powrprof - build(windows): fix typo in
build.rs - fix(utils): make
ExitCode#[must_use] - refactor(rustup-mode): introduce
ExitCode::bitand*() - fix(rustup-mode): return
ExitCode(1)whenupdate()fails - refactor(rustup-mode)!: remove redundant
ExitCodeinself_update()'s callback - test(cli-misc): simplify
version_mentions_rustc_version_confusion() - fix(rustup-mode): refine output for
rustup --version - fix(rustup-mode)!: don't install toolchain on
rustup --version - chore(deps/renovate): update
automergeschedule forlockFileMaintenance - ci(check): add
taplo fmttest for TOMLs - style: reformat all TOMLs with
taplo - ci(gen-workflows): remove
--quietfromgit diff - refactor: use
#[cfg()]instead ofcfg!()when possible - refactor(self-update): remove outdated
do_pre_install_sanity_checks - Add help message for missing toolchain
- Rename OSProcess to OsProcess
- Rename currentprocess to process
- Forward to Process::var_os() directly
- Fix home_dir() and current_dir() regression
- feat(log): set level of
#[tracing::instrument(err)]toTRACE - feat(log): unhide
tracing::instrumentfrom behindfeature = 'otel' - ci(windows): increase stack size to 16MiB
- Upload Windows artifacts into correct subdirectory
- Fix uploading of Windows build artifacts
- Prepare deployment on master branch
- Grant GitHub Actions workflows access to OIDC token
- chore(deps): update aws-actions/configure-aws-credentials action to v4
- Authenticate CI uploads with OIDC
- Upload release artifacts to new S3 bucket
- chore(deps/renovate): set
prCreationtoimmediate - feat(dist): refine suggestions regarding manifest checksum mismatches
- refactor(config): extract
dist_root_server() - refactor(dist): use
let-elseindl_v2_manifest() - refactor(dist/notifications)!: inline usages of
Notification::ManifestChecksumFailedHack - refactor(install): avoid extra clone in
InstallMethod::install - Reorder operations in order to simplify
- Deduplicate handling of environnment variables
- Move if_not_empty() to calling module
- feat(cli): warn when removing the default/active toolchain
- feat(cli): improve warning when removing the last/host target for a toolchain
- docs(ci): simplify the target policy in the README
- Add loongarch64-unknown-linux-musl support
- fix(download): fix build error with
--no-default-features --features=curl-backend - feat(rustup-init): set log level to
WARNon-qifRUSTUP_LOGis unset - implements quiet flag in
rustup-init.sh - test(manifestation): introduce and migrate tests to
TestContext - chore(manifestation): organize imports
- add regression tests for smart guess
- apply smart guess to
rustup update/uninstall self - Disable automatic self updates in CI environments
- feat(download/rustls): use
rustls-platform-verifier - ci(windows): run
cargo all-features - fix(self-update/windows): address some
unused_importswarnings - fix(rustup-mode): improve
claperror format - Add period in warning while checking existing rust installations
- Move Windows-only test code into windows module
- Asyncify CLI tests
- Use guard type to replace with_saved_path()
- Refactor test registry state to be more type safe
- Inline single-use with_saved_global_state() function
- Privatize with_saved_global_state()
- Move change_dir() into CliTestContext
- Move with_update_server() into CliTestContext
- Remove Config::with_scenario()
- Port cli_v2 to CliTestContext
- Port cli_v1 to CliTestContext
- Port cli_self_upd to CliTestContext
- Port cli_rustup to CliTestContext
- Port cli_paths to CliTestContext
- Port cli_misc to CliTestContext
- Port cli_inst_interactive to CliTestContext
- Port cli_exact to CliTestContext
- Use CliTestContext directly in self_update_setup()
- Start CliTestContext type wrapper
- docs(dev-guide/tracing): mention
RUSTUP_LOGand console-based tracing - docs(dev-guide/linting): improve wording
- test(dist): add simple tests for
PartialVersion - chore(dist): add some doc comments
- fix(dist): throw an error when a
PartialVersionstring doesn't start with an ASCII digit - ci(all-features): add
-D warningstocargo check-all-features - fix(currentprocess/filesource): address some
unused_importswarnings - fix(currentprocess): address some
unused_importswarnings - fix(regex): replace
\dto[0-9]to avoid matching non-ASCII digits - refactor(toolchain/names): replace
toolchain_sortwithToolchainName'sOrdinstance - refactor(dist)!: make
ToolchainDesc.channelmore strongly typed - Remove unnecessary lint suppressions
- Use local suppression for clippy::too_many_arguments
- Rename desc fields to toolchain
- Remove intermediate state from error handling
- Remove indirection in update error handling
- Inline wrapper function
- Reduce rightward drift
- Propagate use of DistOptions
- Avoid unnecessary unwrapping
- Extract struct from InstallMethods::Dist variant
- refactor(log): replace the
TELEMETRY_DEFAULT_TARCERsingleton with a function - test(clitools): revive
run_inprocess() - fix(dist/arm): don't assume
armv7if/proc/cpuinfois unavailable - fix(dist): add fallbacks to
/proc/self/exeinrustup-init.sh - Rename default-tls to native-tls
- Inline small errors module
- Inline addition/removal to programs
- Move windows-only self_update code into windows module
- Reorganize platform-dependent imports in self_update
- refactor(log): replace
[Ww]arning:log line prefix withwarn: - refactor(log): rename
NotificationLevel::DebugtoTraceandVerbosetoDebug - Remove unused code
- Hoist Toolchain up into top-level toolchain module
- Remove unused derived sorting implementations
- Privatize internal organization of toolchain module
- Inline argument
- Inline trivial wrapper
- Move toolchain resolution into Cfg method
- Check settings version on Cfg construction
- Move proxy toolchain resolution logic into Cfg method
- Move rustc_version() function into Cfg
- Expose higher-level interface in Toolchain
- Move DistributableToolchain::installed_paths() into Cfg
- No need to store cfg in DistributableToolchain
- Reduce indirection in Cfg::from_partial()
- Move Toolchain::from_partial() to Cfg
- Take owned LocalToolchainName in Toolchain::from_local()
- Simplify Toolchain::from_local()
- refactor(dist): hoist
dist::distintodist - refactor(dist): privatize imports from
dist::dist - Fix the
TODOinsrc\toolchain\toolchain.rs - Use tracing macros directly
- Inline single-caller maybe_trace_rustup()
- Remove rustup test wrapper macros
- Use tokio::main attribute
- Attach Process-dependent utils to Process
- Remove with_runtime()
- fix(config): fix typo in
ActiveReason - fix(log): use
RUSTUP_LOGfor internaltracinginstead ofRUST_LOG - refactor(currentprocess): make use of
Arc::default() - refactor(currentprocess): rename
TestProcess.guardto_guard - Remove currentprocess::with()
- Privatize most TestProcess fields
- Remove unused TestProcess::id
- Pass Process around explicitly
- Let argument parser handle SelfUpdateMode conversion
- Let argument parser handle Profile conversion
- Use simpler form for string concatenation
- Reduce rightward drift by duplicating some Ok-wrapping
- Rename _install_selection() to IInstallOpts::install()
- Inline async closure
- Move error mapping out of validation function
- Rename do_pre_install_options_sanity_checks() to InstallOpts::validate()
- Rename customize_install() to InstallOpts::customize()
- Pass InstallOpts around directly
- refactor(terminalsource): use
.eq_ignore_ascii_case()inColorableTerminal::new - chore(notify): sort logging macros and
NotificationLevelon verbosity - chore(env): retire
RUSTUP_DEBUGin favor ofRUST_LOG - feat(log): make
console_logger()acceptRUSTUP_TERM_COLORandNO_COLOR - refactor(log): reimplement
logusingtracing - refactor(test): clean up
before_test_async() - chore(deps): make
tracing-subscribera hard requirement - refactor(test): setup
tracingsubscriber inbefore_test_async() - test(clitools): disable
run_inprocess() - refactor(test): execute all
#[rustup_macros::unit_test]s within atokiocontext - refactor(log): extract
telemetry() - Remove noop functions in favor of conditional compilation
- Avoid trivial wrapper functions
- Store process name in error variant directly
- Inline trivial wrapper function
- Fix misleading 'uninstalled toolchain' notification
- refactor(ci/run): use more
target_cargo()inrun.bash - Remove trivial new() implementation
- Use serde to encode/decode mock manifests
- Use serde to encode/decode rustup manifests
- Use serde to encode/decode config
- Represent config version as an enum
- Use serde to encode/decode manifests
- Represent manifest version as enum
- Use serde to encode/decode settings
- Add tests for settings encoding
- Derive Default for Settings
- Represent metadata version as an enum
- Use Default impl for Settings::profile default
- Derive Default for Profile
- Discard unnecessary layer of Arc
- Externalize wrapping of DownloadTracker
- Inline NotifyOnConsole
- Internalize interior mutability for Notifier
- Decouple Cfg from Notifier initialization
- fix(dist/triple): ensure
dist::triple::knownis up to date withplatforms - refactor(toolchain): reuse
dist::triple::knownintoolchain::names - refactor(dist/triple): move known triples to
dist::triple::known - refactor(build): use
platformsto verifyRUSTUP_OVERRIDE_BUILD_TRIPLE - refactor(build): simplify the code obtaining the current triple
- feat(cli): add
--quiettorustup (target|component) list - feat(cli): add
--quiettorustup toolchain list - Inline trivial single-use function utils::to_absolute()
- Inline trivial single-use function Cfg::which_binary()
- Inline short single-use function direct_proxy()
- Rename new_toolchain_with_reason() to Toolchain::with_reason()
- Move Cfg::maybe_do_cargo_fallback() to Toolchain
- Move Cfg::create_command_for_toolchain() to Toolchain::command()
- Extract common usage of Cfg::create_command_for_toolchain()
- Inline trivial single-use function Cfg::create_command_for_dir()
- Inline simple function Cfg::create_command_for_toolchain()
- Move toolchain construction out of Cfg::create_command_for_toolchain()
- Inline single-use function
- Improve error message for failing .rustup creation
- Inline trivial single-use function
- Inline utils::current_dir()
- Take explicit current_dir argument in to_absolute()
- Pass current_dir down from main()
- Update rustup.rs website to offer Rustup on Windows on Arm
- Use Cfg::current_dir in override_remove()
- Use Cfg::current_dir in override_add()
- Use Cfg::current_dir in find_or_install_active_toolchain()
- Use Cfg::current_dir for create_command_for_dir()
- Use Cfg::current_dir for find_or_install_active_toolchain()
- Store current_dir in Cfg for use in find_active_toolchain()
- Enable building Rustup win-aarch64 on PR
- Add aarch64-apple-darwin and aarch64-pc-windows-msvc to cloudfront-invalidation.txt
- Update Other installation methods page to include aarch64-pc-windows-msvc
- Remove unnecessary trait abstraction
- Simplify process access to current_dir
- Simplify process access to environment variables
- Remove unnecessary trait bound for home::Env
- Simplify process access to pid
- Simplify process access to stdin
- Simplify process access to stderr
- Simplify process access to stdout
- Simplify process access to argument iterator
- fix(download): work around
hyperhang issue by adjustingreqwestconfig - test(download): fix clippy warnings regarding
Mutexinasync - test(dist): add regression tests for parsing beta versions with tags
- test(dist): introduce scenario
BetaTagwith mock test data - feat(dist): add support for parsing beta versions with tags in the toolchain
- refactor(utils): move
run_future()undermanifestation - feat(config): make
create_command_for_toolchain()async - refactor(config): make
update_all_channels()async - refactor(self_update): make
maybe_install_rust()async - refactor(config): make
ensure_installedasync - fix expected path-separators on windows
- add a regression test
- consistently add context with file path when parsing fails
- ci(windows/gnu): install
mingwviabwoodsend/setup-winlibs-action - ci(windows): enable CI on
x86_64-pc-windows-gnu - Make manifestation test update_from_dist async
- Make update async
- Make default_ async
- Make check_updates async
- Make target_add async
- Make target_remove async
- Make component_add async
- Make component_remove async
- Make update_all_channels async
- Make toolchain_link async
- Make override_add async
- Make DistributableToolchain::remove_component async
- Make DistributableToolchain::add_component async
- Make DistributableTool::install_if_not_installed async
- Make DistributableToolChain::install async
- Make toolchain.update async
- Make update_extra async
- Make show_dist_version async
- Make InstallMethod::install async
- Make InstallMethod::run async
- Make update_from_dist async
- Make update_from_dist_ async
- Make try_update_from_dist_ async
- Make update_v1 async
- Make dist::dl_*_manifest async
- Make common::self_update async
- Make manifestation::update async
- Make download retries async
- Make DownloadCfg::download_and_check async
- Make DownloadCfg::download_hash async
- Make self_update::update async
- Make check_rustup_update async
- Make prepare_update async
- Make get_available_rustup_version async
- Make setup_mode::main async
- Make self_update::install async
- Make try_install_msvc async
- Make download_file async
- Make DownloadCfg::download async
- Make download_file_with_resume async
- Make download_file_ async
- Make download_to_path_with_backend async
- Make download_with_backend async
- Make rustup_mode::main async
- Convert run_rustup_inner to async
- Make run_rustup async
- Remove maybe_trace_rustup runtime setup
- Make maybe_trace_rustup async
- Convert main to using a tokio runtime always
- Ring 0.17.x support Windows on ARM
- ci(macos): use
macos-latestinstead ofmacos-14 - fix(deps): update rust crate itertools to 0.13
- fix(deps): update rust crate pulldown-cmark to 0.11
- Avoid unnecessary allocations
- Attempt to reduce duplication by adding a little abstraction
- Move explicit_desc_or_dir_toolchain() to Toolchain::from_partial()
- Propagate ExitStatus instead of custom ExitCode
- Use precise internal imports
- Use idiomatic way to proxy str data
- Inline RustupSubcmd::dispatch()
- refactor(filesource): replace repetitive
#[cfg()]usages with a newmod - Fix ETA display after regression
- Stop showing ETA after download is complete
- refactor(cli): hoist the
handle_epipe()call out of thematch - refactor(cli): rewrite
rustupitself withclap-derive - refactor(cli): rewrite
rustup (self|set)withclap-derive - refactor(cli): rewrite
rustup (man|completions)withclap-derive - refactor(cli): rewrite
rustup docwithclap-derive - refactor(cli): rewrite
rustup (run|which|dump-testament)withclap-derive - refactor(cli): rewrite
rustup overridewithclap-derive - refactor(cli): rewrite
rustup componentwithclap-derive - refactor(cli): rewrite
rustup targetwithclap-derive - refactor(cli): rewrite
rustup (check|default)withclap-derive - refactor(cli): rewrite
rustup (toolchain|update|(un)?install)withclap-derive - refactor(cli): remove
deprecated() - refactor(cli): rewrite
rustup showwithclap_derive - fix(rustup-init): fix typo in
rustup-init[.sh]args - feat(download): reflect the download/TLS backends in the user agent
- Make find_override_from_dir_walk return OverrideCfg
- Make settings file allow multiple borrows
- Fix doc error with
rust-toolchain.tomlcustom TC - Make
rustup defaultnot error if no default - Update format of
toolchain list - Update format of
showandshow active-toolchain - Redesign OverrideCfg to be more type-driven
- Pull match statement out in OverrideCfg::from_file()
- Change find_override to find_active_toolchain
- Pull out
new_toolchain_with_reason() - Pull out
ensure_installed() - refactor(cli): reorder
ifstatement incli::setup_mode::main() - refactor(cli): rewrite
rustup-initwithclap_derive - Avoid code duplication for printing target/component items
- Deduplicate code to get components from distributable
- Merge list_{,installed_}targets
- Merge list_{,installed_}components functions
- fix(filesource): make some constructs only available via the
testfeature - fix(ci/freebsd): install ca certs to prevent
invalid peer certificate: UnknownIssuer - feat(download-backend)!: make
reqwest/rustlsthe new default - feat(download-backend)!: refine selection logic
- Update MSVC requirements to VS 2017 to match Rust repo
- refactor(download): use
DownloadCallBackindownload_with_backend() - ci: don't build for
i686-linux-androiddue to OpenSSL v3 atomic issues - ci(android): update NDK version
- fix(deps): update rust crate openssl-src to v300
- ci(linux-gnu): install
perl-IPC-Cmdto make OpenSSL v3 happy - chore(deps): update ubuntu docker tag to v24
- docs(dev-guide): remove 'pushing to master' in the release process
- Replace remaining winapi usage with windows-sys
Update to version 1.27.1~0:
- chore(dist): update commit shasum in
rustup-init.sh, take 2 - fix(ci/linux): don't use
pip3to installawscli - fix(ci/macos): don't use
pip3to installawscli - chore(dist): update commit shasum in
rustup-init.sh - docs: update CHANGELOG for v1.27.1
- feat(dist): improve
changelog_helperscript - dist: bump
rustupversion to1.27.1 - chore: fix some typos in comments
- Remove TryFrom for TargetTriple
- Add tests for add/remove components by name with target triple
- Replace Component::new_with_target by Component::try_new
- refactor(self-update)!: remove confusing
get_path()impl on Unix - test(self-update): ensure the resolution of #3739
- feat(self-update): add
with_saved_reg_value() - refactor(self-update): extract
(get|restore)_reg_value() - refactor(self-update): extract
with_saved_global_state() - refactor(self-update): use
std::io - fix(self-update): replace some
#[cfg(not(unix))]usages with#[cfg(windows)] - feat(self-update): improve error messages on Windows
- fix(self-update): run
do_update_programs_display_version()onrun_update() - refactor(self-update): extract
get_and_parse_new_rustup_version() - refactor(self-update): extract
do_update_programs_display_version() - ci: don't test for FreeBSD on PRs
- docs(user-guide): update
environment-variables - refactor(self-update): eliminate needless clone
- feat(self-update): log
RUSTUP_DIST_*if it's set - feat(self-update): log
RUSTUP_UPDATE_ROOTif it's set - refactor(self-update): rename
UPDATE_ROOTtoDEFAULT_UPDATE_ROOT - refactor(self-update): extract
update_root() - once_cell only used with reqwest in download crate, so gate it
- tracing unsed only from otel feature, so move it to optional
- Add loongarch64-unknown-linux-gnu to installation docs
- Add loongarch64-unknown-linux-gnu to cloudfront invalidations
- Use pattern matching to make Debug impl for Cfg more robust
- Use std IsTerminal interface
- Rename temp::Cfg to Context
- temp: keep definitions and impls together
- Remove derivative dependency in favor of manual implementation
- docs(dev-guide): move all mentions of
cargo clippytolinting.md - docs(dev-guide): mention that we need to keep mdBook links stable
- refactor(utils)!: rename
delete_dir_contents()todelete_dir_contents_following_links() - fix(utils): resolve input path in
delete_dir_contents()if it's a link - test(cli): ensure the resolution of #3344
- Revert 'fix(utils): unlink input path in
delete_dir_contents()if it's a link' - Revert 'refactor(utils)!: rename
delete_dir_contents()todelete_dir_contents_or_unlink()' - Revert 'test(cli): ensure the resolution of #3344'
- refactor(utils)!: rename
delete_dir_contents()todelete_dir_contents_or_unlink() - fix(utils): unlink input path in
delete_dir_contents()if it's a link - test(cli): ensure the resolution of #3737
- refactor(util)!: rename
open_dir()toopen_dir_following_links() - fix(utils): don't use
O_NOFOLLOWinopen_dir() - chore: fix typo in
CHANGELOG - chore(meta): update
bug_reportissue template - Add hr to Windows instructions
- fix(doc): don't show the opening message when --path is used
- chore: remove repetitive words
- fix(deps): update rust crate opener to 0.7.0
- fix(config): remove unnecessary debug print
- fix(ci): fix file paths in CI-generated
*.sha256files on *nix - fix(ci): correct error message after bumping reqwest
- fix(deps): update rust crate reqwest to 0.12
- doc(dev-guide): Fix test Lint and add explanation
- Fix 'component add' error message
- ci: use
stableRust for all clippy lints - style: apply clippy suggestions from Rust 1.78.0
- fix(ci/windows): disable
cargo clippyon*-windows-gnu - fix(shell): create parent dir before appending to rcfiles
- fix(fish): fix definition of
Fish::update_rcs - docs(dev-guide): update
release-process.mdto match the new workflow based on GitHub Merge Queue - ci(macos): add
MACOSX_DEPLOYMENT_TARGETand friends - Replaced
.withsourcein fish shell'ssource_string - Deny clippy warnings in CI
- Rely on implicit conversion to OperationResult
- Extract closure from match scrutinee
- fix(cli): fix incorrect color state after
ColorableTerminal::reset - docs: Add note about stability of llvm-tools.
- Change default for RUSTUP_WINDOWS_PATH_ADD_BIN
- ci: remove direct
renovate/*tests - Fix dead_code and unused_imports warnings
Update to version 1.27.0~0:
- docs: update
CHANGELOGfor v1.27.0 - hack(deps): pin
openssl-systo 0.9.92 - fix #3663. Feedback in terminal when opening browser for docs
- Fix copy icon position in Safari
- Upgrade to opentelemetry 0.22
- fix ambiguous prompt after setting up custom installation
- docs: rephrase and split sentence about Visual Studio license
- Add comment on why we prefer symlinks to junctions
- Windows: Try using symlinks if they're allowed
- chore(ci): unify the matrix format to (mode, target)
- ci: update runners for macOS-related workflows
- docs: mention
aptin installation methods - docs: fix missing links in
CHANGELOG.md - chore(deps): update rust crate trycmd to 0.15.0
- fix(deps): downgrade
openssl-systo 0.9.92 - ci: remove the now-tier3
mips*-unknown-linux-gnu*targets from the build - Update mdbook and fix some source issues.
- Rename
.cargo/configto.cargo/config.toml - chore: update
CHANGELOG.md - dist: bump
rustup-init.shversion to1.27.0 - dist: bump
rustupversion to1.27.0 - feat: introduce
changelog_helperscript - Upgrade to pulldown-cmark 0.10
- Fix some typos
- fix(deps): update rust crate libc to 0.2.153
- Download rust CI Docker images from a registry
- Component is now named 'llvm-tools'
- chore: add docstring to
is_32bit_userspace() - chore: disable some unix-only helper functions on Windows
- chore(deps): update actions/cache action to v4
- refactor(cli): simplify case splitting on
clap::error::ErrorKind - refactor(names): replace
maybe_official_toolchainame_parserwithimpl FromStr - refactor: simplify
is_proxyable_tools - refactor(distributable): import
ComponentStatus - refactor(cli): avoid nested combinators in
has_at_most_one_target - feat(cli): warn when removing the last/host target for a toolchain
- refactor(toolchain): extract
DistributableToolchain::components() - www: detect RISC-V 64 platform
- fix(deps): update rust crate strsim to 0.11
- chore(deps): update
renovate.jsonto remove version bumps covered by lockfile maintenance PRs, take 3 - feat(ci): configure
merge_queueto be a PR-like event - feat(ci): enable the
merge_grouptrigger - fix(ci): use
github.event_name == 'schedule'instead ofgithub.event.schedule - chore(deps): update
renovate.jsonto remove version bumps covered by lockfile maintenance PRs, take 2 - fix(deps): update rust crate clap to v4.4.13
- fix(deps): update rust crate syn to v2.0.48
- chore(deps): update rust crate opentelemetry_sdk to v0.21.2
- fix(ci): use
github.event_name == 'push'instead ofgithub.event.push - feat(ci): add CI workflow generation checks
- refactor(ci): disassemble and reorganize
ci/cirrus-templates - feat(ci): add
conclusionjob - refactor(ci): move
freebsd-buildsto GitHub Actions - refactor(ci): merge all current GitHub Actions workflows into
ci.yaml - chore(ci): clean up current CI files
- chore(deps): update
renovate.jsonto remove version bumps covered by lockfile maintenance PRs - fix(deps): update rust crate syn to v2.0.47
- fix(deps): update rust crate proc-macro2 to v1.0.75
- fix(deps): update rust crate clap_complete to v4.4.6
- fix(deps): update rust crate serde to v1.0.194
- fix(deps): update rust crate semver to v1.0.21
- chore(deps): update rust crate thiserror to v1.0.56
- chore(deps): update rust crate anyhow to v1.0.79
- fix(deps): update rust crate syn to v2.0.45
- fix(deps): update rust crate proc-macro2 to v1.0.73
- fix(deps): update rust crate syn to v2.0.44
- fix(deps): update rust crate quote to v1.0.34
- fix(deps): update rust crate proc-macro2 to v1.0.72
- chore(deps): update rust crate anyhow to v1.0.78
- chore(deps): update rust crate thiserror to v1.0.53
- fix(deps): update rust crate clap to v4.4.12
- chore(deps): update rust crate tempfile to v3.9.0
- fix(deps): update rust crate clap_complete to v4.4.5
- chore(deps): update rust crate anyhow to v1.0.77
- chore(deps): update rust crate thiserror to v1.0.52
- fix(deps): update rust crate syn to v2.0.43
- fix(deps): update rust crate openssl to v0.10.62
- fix(deps): update rust crate proc-macro2 to v1.0.71
- fix(deps): update rust crate syn to v2.0.42
- chore(deps): update rust crate anyhow to v1.0.76
- chore(deps): update rust crate hyper-util to v0.1.2
- chore(deps): update rust crate tokio to v1.35.1
- fix(deps): update rust crate reqwest to v0.11.23
- chore(deps): update rust crate hyper to v1.1.0
- docs: move 'rls' and 'rust-analysis' to separate section 'previous...' (#3591)
- chore(deps): update actions/upload-artifact action to v4
- Fix rustup-init failure to read ZDOTDIR from zsh when SHELL is not zsh (#3584)
- CI: Enable rustls on loongarch64
- CI: Revert 'Disable openssl for loongarch64-unknown-linux-gnu'
- fix(deps): update rust crate openssl-src to v300.2.1+3.2.0
- fix(deps): update rust crate syn to v2.0.41
- fix(deps): update rust crate syn to v2.0.40
- fix(deps): update rust crate libc to v0.2.151
- chore(deps): update rust crate once_cell to v1.19.0
- fix(deps): update rust crate clap to v4.4.11
- fix(deps): update rust crate openssl to v0.10.61
- Fix test permanently adding to PATH
- chore(deps): revert
Cargo.tomlbump in #3540 - chore(deps): revert
Cargo.tomlbump in #3532 - chore(renovate): prevent unnecessary
Cargo.tomlbumps - Lock file maintenance
- Fix panic in
component list --toolchain stable - Upgrade hyper to 1.0 (#3543)
- Clarify several docs and help messages
- Remove rel paths from rust-toolchain.toml docs
- CI: Disable openssl for loongarch64-unknown-linux-gnu
- Update Rust crate url to 2.5
- Update Rust crate winreg to 0.52
- Update Rust crate windows-sys to 0.52.0
- Update Rust crate termcolor to 1.4
- Streamline dependencies in
Cargo.toml - Update opentelemetry
- [doc] windows.md: fix link
- Inline channel pattern list
- Remove unused import
- Explicitly import symbols
- Remove unused dependencies from macros crate
- Replace usage of lazy_static with once_cell
- Use more conventional field order in package table
- Remove authors from Cargo manifest (per RFC 3052)
- Use uniform dependency specification style
- Inline
semver::Versionintoolchain_sort - Add docs specifying
toolchain_sort's expected behavior - Change key used in
toolchain_sort - Inline
special_versionintoolchain_sort - Inline
toolchain_sort_keyintoolchain_sort - Replace
sort_bywithsort_by_keyintoolchain_sort - Refine
test_toolchain_sort - Suggest installing MSYS2 for
windows-gnu - Fix the test toolchain_broken_symlink on Windows
- Move
TOOLSTATE_MSGtodistto serve toolchain-wide operations - Add test to ensure resolution of #3418
- Add
Panicssections to docstrings - Refactor
components_*_msg - Delete suggestions of removing the relevant component from
component_unavailable_msg - Clean up some
manifestationlogic - Warn when running under Rosetta emulation
- Typo fixed in tips-and-tricks.md file
- Adjust suggestions about sourcing
envfiles - Restrict zsh
shwordsplittodownloader() - Update Rust crate zstd to 0.13
- Apply
clippysuggestions - Extract
post_install_msg_unix_source_env!() - Add suggestions to mention sourcing
env.fish - Fix zsh word splitting for curl '--retry 3'
- Add ksh compatibility for latest illumos and others
- Remove redundant message if an error occurs during package extraction
- Update Rust crate regex to 1.10.0
- Write a custom env script for fish
- Fix fish config dir paths
- Update all rc fish scripts
- Try to add support for fish shell
- Clarify the origin of
rust-$TARGETCI Docker images - Apply more
clippysuggestions - Capturing IO error in download_file_with_resume (#3421)
- Adjust instructions for manual installation (#3502)
- Windows: Load DLLs from system32
- When running a 32-bit rustup on an aarch64 CPU, select a 32-bit toolchain
- Do not fallback to 'arm' in rustup-init.sh on aarch64 with 32-bit userland
- Update Rust crate toml to 0.8
- Mention
brew install rustup-initin the user guide - Adjust section titles in the user guide
- Update actions/checkout action to v4
- Avoid warning for unused variant
- fix invalid link for 1.25.2
- 1.26.0 should not be unreleased in the changelog
- Refactor test case
install_uninstall_affect_path - Update Rust crate winreg to 0.51
- Apply clippy suggestions from Rust 1.74 (#3497)
- Fix rustup_only_options_stdout
- Bring additional help section style in line with clap 4
- Upgrade to clap 4
- Avoid deprecated clap API
- Isolate trycmd tests from environment
- Update Rust crate tracing-opentelemetry to 0.21.0
- buf writes to components
- Update Rust crate tempfile to 3.8
- Return the right lifetime from DistributableToolchain::install
- Fix handling of async tests
- Improve CI debugability
- Refactor: Use download_cfg.notify_handler in update()
- Authenticate when installing protoc
- Avoid installing protoc for most CI workflows
- Refine suggestions of sourcing
$HOME/.cargo/env - Avoid
sysctl: unknown oidstderr output and/or non-zero exit code - Configure automerge in Renovate
- Fix renovate.json
- Make
RUSTUP_TERM_COLOR's value case insensitive - Add unit tests for
RUSTUP_TERM_COLOR - Support
RUSTUP_TERM_COLORas an override environment variable - macOS
uname -mcan lie due to Rosetta shenanigans - Migrate CONTRIBUTING.md to an mdbook
- Build docs during CI
- Move the user guide from doc to doc/user-guide
- Update Rust crate tempfile to 3.7
- Use available_parallelism replace the
num_cpuscrate - rustup-init.sh: Check for kernel UAPI compatibility on LoongArch
- Enable loongarch64-linux-gnu builds on stable
- allow
clippy::arc_with_non_send_sync - Address
#[warn(clippy::useless_vec)] - Address
#[warn(clippy::needless_borrow)] - Address
#[warn(clippy::useless_conversion)] - Address
#[warn(clippy::redundant_pattern_matching)] - Address
#[warn(clippy::redundant_field_names)] - Bump proc-macro2 v1.0.51 -> v1.0.63
- Bump the openssl v0.10.52 -> v0.10.55
- Fix typo: prerequistes -> prerequisites
- update installation methods to use TLS v1.2
- Disable the 'oldtime' feature of chrono
- Update Rust crate tempfile to 3.6
- Update Rust crate url to 2.4
- Update Rust crate once_cell to 1.18.0
- Make download_tracker thread safe.
- Enable broken color in MSYS2 shells
- Add suggest_message helper for errors
- replace term with termcolor
- Tweak docs
- Improve error message for removing uninstalled target
- Improve error message for adding unknown target
- CI support for loongarch64-unknown-linux-gnu
- Fix compile on rust nightly
- Group updates to opentelemetry together
- Improve CurrentProcess
- Update dependencies
- TestProcess and friends should be test only
- Update Rust crate windows-sys to 0.48.0
- Rework Toolchain model and drop relative file path overrides
- Add in opentelemetry tracing as a feature
- Remove repeated definite article
- Make clippy happy
- Update Rust crate toml to 0.7.3
- Suggest right toolchain when running clippy
- Fix small typo
- Update Rust crate winreg to 0.50
- Update Rust crate tempfile to 3.5
- Compile static Mutex where possible
- Upgrade CI image to FreeBSD 13.2
- Update Rust crate opener to 0.6.0
- Update Rust crate enum-map to 2.5.0
- Bumped retry
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:2831-1
- E-Mail link for SUSE-SU-2026:2831-1
- SUSE Security Ratings
- SUSE Bug 1203257
- SUSE Bug 1230032
- SUSE Bug 1243862
- SUSE Bug 1249008
- SUSE Bug 1257902
- SUSE Bug 1270186
- SUSE Bug 1270521
- SUSE Bug 1270619
- SUSE Bug 1270644
- SUSE Bug 1270795
- SUSE Bug 1270870
- SUSE Bug 1270874
- SUSE Bug 1270989
- SUSE CVE CVE-2024-12224 page
- SUSE CVE CVE-2025-58160 page
- SUSE CVE CVE-2026-25727 page
- SUSE CVE CVE-2026-41676 page
Описание
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
Затронутые продукты
Ссылки
- CVE-2024-12224
- SUSE Bug 1243848
Описание
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.
Затронутые продукты
Ссылки
- CVE-2025-58160
- SUSE Bug 1249007
Описание
time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.
Затронутые продукты
Ссылки
- CVE-2026-25727
- SUSE Bug 1257901
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78.
Затронутые продукты
Ссылки
- CVE-2026-41676
- SUSE Bug 1270137
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.
Затронутые продукты
Ссылки
- CVE-2026-41677
- SUSE Bug 1270540
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function. This vulnerability is fixed in 0.10.78.
Затронутые продукты
Ссылки
- CVE-2026-41678
- SUSE Bug 1270641
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.
Затронутые продукты
Ссылки
- CVE-2026-41681
- SUSE Bug 1270719
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.
Затронутые продукты
Ссылки
- CVE-2026-41898
- SUSE Bug 1270798
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant - resulting in undefined behavior. This vulnerability is fixed in 0.10.79.
Затронутые продукты
Ссылки
- CVE-2026-42327
- SUSE Bug 1270454
Описание
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This only impacts users using AES key-wrap-with-padding ciphers. This vulnerability is fixed in 0.10.79.
Затронутые продукты
Ссылки
- CVE-2026-44662
- SUSE Bug 1270872
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-45784
- SUSE Bug 1270946