CVE-2018-1000622
First published: Mon Jul 09 2018(Updated: )
The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rust-lang Rust | >=0.8<=1.27.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00076.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00031.html
- https://groups.google.com/forum/#!topic/rustlang-security-announcements/4ybxYLTtXuM
- https://security.gentoo.org/glsa/201812-11
- https://groups.google.com/forum/#%21topic/rustlang-security-announcements/4ybxYLTtXuM
Frequently Asked Questions
What is CVE-2018-1000622?
CVE-2018-1000622 is a vulnerability in the Rust Programming Language rustdoc version Between 0.8 and 1.27.0 that allows for local code execution as a different user.
How severe is CVE-2018-1000622?
CVE-2018-1000622 is considered to be a high severity vulnerability with a CVSS score of 7.8.
What is the affected software?
The affected software is Rust Programming Language rustdoc version between 0.8 and 1.27.0.
How can CVE-2018-1000622 be exploited?
CVE-2018-1000622 can be exploited by using the --plugin flag without the --plugi…
Is there a fix available for CVE-2018-1000622?
Yes, updating to a version of Rust Programming Language rustdoc above 1.27.0 will fix the CVE-2018-1000622 vulnerability.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/rust-lang
- canonical/rust-lang rust
- version/rust-lang rust/0.8
- version/rust-lang rust/1.27.0