[CLSA-2026:1791195534] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-10-05 10:19:11 UTC
Description:
* SECURITY UPDATE: cargo unpacks symlinks and other unexpected entry types from registry archives - debian/patches/CVE-2026-5223.patch: reject any entry that is not a regular file or a directory when unpacking a .crate in src/tools/cargo/src/cargo/sources/registry/mod.rs, so a hand-built archive from an alternate registry can no longer place a symlink in the registry source cache - CVE-2026-5223 * SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:33b7b4026c18f64ddb6ca707ec749efa14fa426a
  • cargo1.9-doc_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:1639cde861bf7945b7d4098f844b31acf4bb57ba
  • libstd-rust1.9-1.90_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:76cd0d0479533aa9926cdc10f3f9751e179efb4d
  • libstd-rust1.9-dev_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:9faf23d893ff79714ee411fcce90466994b251ed
  • rust1.9-all_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:f14f7239c114a74815691f848e3fc8c4e84b09e3
  • rust1.9-analyzer_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:5023b68813e5eb86cdd378b2267d31f84828091f
  • rust1.9-clippy_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:da879985ecac9cc43255a94019c868d21c986b20
  • rust1.9-doc_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:9587afe2406de57fce36d492feddacc1032fc774
  • rust1.9-gdb_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:fa265fc0eb397be5f0370478c3f2a68921fa5cce
  • rust1.9-lldb_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:f0344e77d772579bdaf4ef2d4787ec9449f4767c
  • rust1.9-llvm_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:6b8b470880932d8c1abab2d1272a80699343dd2c
  • rust1.9-src_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:c64799aea323ed810d702160130cf5687ed7b1d4
  • rustc1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:5b74f71eb8933acd1fa652c402efd4c6fdbc9d6b
  • rustfmt1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:42721c7b21d50538cc596c286279c69b365b5f92
  • cargo1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:13c0a6f710c56dc81a7ded0dd1c4f3e4ea7b0d86
  • libstd-rust1.9-1.90_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:2646c28d1d9a85b78bc8e1395ae25615d4db6092
  • libstd-rust1.9-dev_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:c6d19c7d02724786ca5135c634c3be23afad889c
  • rust1.9-analyzer_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:bf3c57de9d9773920935ce178f80677a9659fe91
  • rust1.9-clippy_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:71d67b6b46a50079859ef02447c0688ee9b70fa1
  • rust1.9-llvm_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:d6ace14c959e1d6a855cacc87ea386d5268a81e4
  • rustc1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:69ea019e310b82b3d38982b00c284cc827f70d04
  • rustfmt1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:435762f75c8f20cd07903505fd8563e2ee210ce9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.