exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 7 of 7 RSS Feed

CVE-2023-38497

Status Candidate

Overview

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

Related Files

Gentoo Linux Security Advisory 202409-07
Posted Sep 23, 2024
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202409-7 - Multiple vulnerabilities have been discovered in Rust, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.71.1 are affected.

tags | advisory, arbitrary, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2022-46176, CVE-2023-38497
SHA-256 | e5aa40d2adbb6aac1c253359c2433878f2e3e48f28339de699e1484a5cf832f9
Red Hat Security Advisory 2024-3428-03
Posted May 29, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-3428-03 - An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

tags | advisory
systems | linux, redhat
advisories | CVE-2023-38497
SHA-256 | c52460f17c34f2f7db626b0011c99f88cca044a7b16dbf38dc43c26b7396bcc7
Red Hat Security Advisory 2024-3418-03
Posted May 29, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-3418-03 - An update for rust is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.

tags | advisory
systems | linux, redhat
advisories | CVE-2023-38497
SHA-256 | 28bf85c7cd7d3c6be9f84c46399a86e1fcf6b01fadbfa2a09a374be52c05c74f
Red Hat Security Advisory 2023-4651-01
Posted Aug 15, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-4651-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

tags | advisory
systems | linux, redhat
advisories | CVE-2023-38497
SHA-256 | 7fdfffee94555d06a4b01161da79f0618d8ac96ff00f9ff7f1c19cf3842f573c
Red Hat Security Advisory 2023-4635-01
Posted Aug 15, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-4635-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

tags | advisory
systems | linux, redhat
advisories | CVE-2023-38497
SHA-256 | db26cb8a873428f876f2e7a4529ec2cf4d6d15c79d795501246c879819b52631
Red Hat Security Advisory 2023-4634-01
Posted Aug 15, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-4634-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

tags | advisory
systems | linux, redhat
advisories | CVE-2023-38497
SHA-256 | 066651121c75a921764782f330be26004c357892888390ee680b673b49ca81a4
Ubuntu Security Notice USN-6275-1
Posted Aug 4, 2023
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 6275-1 - Addison Crump discovered that Cargo incorrectly set file permissions on UNIX-like systems when extracting crate archives. If the crate would contain files writable by any user, a local attacker could possibly use this issue to execute code as another user.

tags | advisory, local
systems | linux, unix, ubuntu
advisories | CVE-2023-38497
SHA-256 | f2966c79576ad4d4b94a6d3844273a23c1a3674ca05ab3e471da58790232a5aa
Page 1 of 1
Back1Next

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    48 Files
  • 20
    Sep 20th
    36 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    38 Files
  • 24
    Sep 24th
    65 Files
  • 25
    Sep 25th
    24 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close