Key Exchange without Entity Authentication Affecting cargo package, versions <0.67.1


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.09% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUST-CARGO-3227927
  • published11 Jan 2023
  • disclosed10 Jan 2023
  • creditJulia Security Team

Introduced: 10 Jan 2023

CVE-2022-46176  (opens in a new tab)
CWE-322  (opens in a new tab)

How to fix?

Upgrade cargo to version 0.67.1 or higher.

Overview

cargo is a Cargo, a package manager for Rust.

Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to missing SSH host key and server's public key verifications when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks.

Note: Even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [url.<base>.insteadOf][1] setting), as that'd cause you to clone the crates.io index through SSH.

Workaround

If an upgrade is impossible, it is recommended to configure Cargo to use the git CLI instead of its built-in git support. That way, all git network operations will be performed by the git CLI, which is not affected by this vulnerability. You can do so by adding this snippet to your Cargo configuration file:

[net]
git-fetch-with-cli = true

CVSS Scores

version 3.1