[USN-6275-1] Cargo vulnerability

[David Fernandez Gonzalez]

==========================================================================
Ubuntu Security Notice USN-6275-1
August 03, 2023

cargo, rust-cargo vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

Cargo could be made to run programs as your login if it
installed a specially crafted crate.

Software Description:
- cargo: Rust package manager
- rust-cargo: Rust package manager - feature "openssl"

Details:

Addison Crump discovered that Cargo incorrectly set file permissions
on UNIX-like systems when extracting crate archives. If the crate would
contain files writable by any user, a local attacker could possibly use
this issue to execute code as another user.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS (Available with Ubuntu Pro):
   cargo 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1
   librust-cargo+openssl-dev       0.57.0-1ubuntu0.1~esm1
   librust-cargo-dev               0.57.0-1ubuntu0.1~esm1

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
   cargo 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   cargo 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   cargo 0.47.0-1~exp1ubuntu1~16.04.1+esm1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6275-1
   CVE-2023-38497


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230803/2ce9de38/attachment-0001.sig>