Описание
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write "ok" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you wa...
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needs-triage |
| devel | DNE | |
| esm-apps-legacy/xenial | needed | |
| esm-apps/bionic | needed | |
| esm-apps/focal | released | 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2 |
| esm-apps/jammy | released | 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2 |
| esm-apps/xenial | ignored | end of ESM support, was needed |
| focal | released | 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2 |
| jammy | released | 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2 |
| kinetic | ignored | end of life, was needs-triage |
Показывать по
EPSS
4.6 Medium
CVSS3
Связанные уязвимости
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write "ok" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want
Cargo is a package manager for the rust programming language. After a ...
Cargo extracting malicious crates can corrupt arbitrary files
EPSS
4.6 Medium
CVSS3