RHSA-2024:3418: Important: rust security update
Published May 28, 2024
·Updated
Important: rust security update
Other sources
Rust Toolset provides the Rust programming language compiler rustc, the cargo<br>build tool and dependency manager, and required libraries.<br>Security Fix(es):<br><li> rust-cargo: cargo does not respect the umask when extracting dependencies</li> (CVE-2023-38497)<br>For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s)<br>listed in the References section.
— Red Hat
Affected Software
71 affected componentsFixes available
redhat/rust<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo-doc<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/clippy<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/clippy-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/clippy-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rls<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rls-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rls-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-analysis<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debugger-common<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debugsource<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debugsource<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-doc<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-gdb<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-lldb<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-src<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-std-static<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-std-static<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-std-static-wasm32-unknown-unknown<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-std-static-wasm32-wasi<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rustfmt<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rustfmt-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rustfmt-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/clippy<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rls<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-analysis<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-doc<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rustfmt<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/clippy<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/clippy-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rls<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rls-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-analysis<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-debugsource<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-doc<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rust-std-static<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rustfmt<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/rustfmt-debuginfo<1.58.1-1.el9_0.1
1.58.1-1.el9_0.1
redhat/cargo<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/cargo-debuginfo<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/clippy<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/clippy-debuginfo<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rls<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rls-debuginfo<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rust<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rust-analysis<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rust-debuginfo<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rust-debugsource<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rust-doc<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rust-std-static<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rustfmt<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
redhat/rustfmt-debuginfo<1.58.1-1.el9_0.1.aa
1.58.1-1.el9_0.1.aa
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates
Red Hat Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Remediation
Event History
May 28, 2024
Advisory Published
via Red Hat·01:04 PM
Jun 1, 2024
Advisory Published
via Red Hat·02:29 PM
Frequently Asked Questions
1
What is the severity of RHSA-2024:3418?
The severity of RHSA-2024:3418 is classified as important.
2
How do I fix RHSA-2024:3418?
To fix RHSA-2024:3418, update the affected packages to version 1.58.1-1.el9_0.1 or later.
3
What software is affected by RHSA-2024:3418?
RHSA-2024:3418 affects various versions of the Rust Toolset components on multiple Red Hat Enterprise Linux platforms.
4
What is the vulnerability described in RHSA-2024:3418?
RHSA-2024:3418 details a security issue where cargo does not respect the umask when extracting dependencies.
5
Is there a workaround for the issues in RHSA-2024:3418?
There is no known workaround for the issues addressed in RHSA-2024:3418, and updating is recommended.