[CLSA-2026:1791196274] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-10-05 10:31:32 UTC
Description:
* SECURITY UPDATE: cargo unpacks symlinks and other unexpected entry types from registry archives - debian/patches/CVE-2026-5223.patch: reject any entry that is not a regular file or a directory when unpacking a .crate in src/tools/cargo/src/cargo/sources/registry/mod.rs, so a hand-built archive from an alternate registry can no longer place a symlink in the registry source cache - CVE-2026-5223 * SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:2cecd251cea075b44be2fae2e79db5ea2d27798d
  • cargo1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:e115f6dad85ccc5402ff0b9172b07ab232db8f6d
  • libstd-rust1.88-1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:1a8cf71400b2c2aba42eaa81d32ab4310f8244eb
  • libstd-rust1.88-dev_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:9aeab0af2b170a5f67b8339ddc4a40f8457ebb94
  • rust1.88-all_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:ed5a8a7b4aeac60ea780e25c88271612bcd9e449
  • rust1.88-analyzer_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:2a1bfef443c4a607a7ae4c58cfcfae4b4da11798
  • rust1.88-clippy_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:d6277a0eacfadb536c93c55d39d538f9a14fe2d6
  • rust1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:3b6224b8d06e5fefb863b560a165f2199dd4bfac
  • rust1.88-gdb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:23eb06f256059c43b44f2a153d7465dfc94989f6
  • rust1.88-lldb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:c3264f663ec0ea319c1875f901a6af1d73779ce2
  • rust1.88-llvm_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:ecd6c2200c3d672f600b94fd4480d16b77deb2fb
  • rust1.88-src_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:2b11fba8beeea4fa95268a51810c1ef49a8ec954
  • rustc1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:d6e96357a2303333c2e974584ecdc2456b49971e
  • rustfmt1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:442234f02559f140d8b877587b588bb67f401a91
  • cargo1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:e221b958ac9801e0e02407cc2860d3e7d3a3391b
  • libstd-rust1.88-1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:3d654ed58c2d5c215e821cffcf65ef9932c774a2
  • libstd-rust1.88-dev_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:5b72e4cb5397abfa324d0899ade89f57970da977
  • rust1.88-analyzer_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:a8011166ae04d39509b294839d4c808542d0da81
  • rust1.88-clippy_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:f228a99cc685cbf02118c021a7c643ae77792299
  • rust1.88-llvm_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:27ef43d9f8a65a0cf2abc275642688ebf7e4e9db
  • rustc1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:cf8ff3c28a996931452e10f8cf15aa33874fa965
  • rustfmt1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:8dbc676268e4d024bddfe4511468101d9031e4ba
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.