Incorrect Default Permissions Affecting rust-doc package, versions <0:1.66.1-2.module+el8.8.0+19613+f0bba33b
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-RUSTDOC-5820744
- published 4 Aug 2023
- disclosed 3 Aug 2023
Introduced: 3 Aug 2023
CVE-2023-38497 Open this link in a new tabHow to fix?
Upgrade Centos:8 rust-doc to version 0:1.66.1-2.module+el8.8.0+19613+f0bba33b or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-doc package and not the rust-doc package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in ~/.cargo.
References
- https://access.redhat.com/security/cve/CVE-2023-38497
- https://en.wikipedia.org/wiki/Umask
- https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff
- https://github.com/rust-lang/cargo/pull/12443
- https://github.com/rust-lang/cargo/security/advisories/GHSA-j3xp-wfr4-hx87
- https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497
- https://www.rust-lang.org/policies/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGKE6PGM4HIQUHPJRBQAHMELINSGN4H4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMEXGUGPW5OBSQA6URTBNDSU3RAEFOZ4/