REDHAT-BUG-2370001: High severity rust users vulnerability
Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.
This affects both:
- The supplementary groups of a user - The group access list of the current process
If the caller uses this information for access control, this may lead to privilege escalation.
This crate is not currently maintained, so a patched version is not available.
Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.
Recommended alternatives - uzers (an actively maintained fork of the users crate) - sysinfo
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2370001?
The severity of REDHAT-BUG-2370001 is high due to the potential for privilege escalation.
How do I fix REDHAT-BUG-2370001?
To fix REDHAT-BUG-2370001, upgrade to the latest version of the affected Rust users software beyond version 0.8.0.
What versions are affected by REDHAT-BUG-2370001?
REDHAT-BUG-2370001 affects Rust users versions prior to 0.8.0.
What are the potential risks associated with REDHAT-BUG-2370001?
The potential risks associated with REDHAT-BUG-2370001 include unauthorized access to sensitive information and privilege escalation.
How can REDHAT-BUG-2370001 impact user access control?
REDHAT-BUG-2370001 can impact user access control by incorrectly appending 'root' to group listings, potentially altering access permissions.