[CLSA-2026:1791330794] Fix CVE(s): CVE-2026-5222
Type:
security
Severity:
Low
Release date:
2026-10-06 23:53:27 UTC
Description:
* SECURITY UPDATE: Registry credential confusion in cargo URL canonicalization - debian/patches/upstream/CVE-2026-5222.patch: skip the GitHub lower-casing and .git-suffix stripping in CanonicalUrl::new for URLs whose scheme contains a '+', so a sparse+https registry URL ending in .git no longer canonicalizes to the same index as its non-.git twin and cannot be sent that registry's credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.85_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:ae5a8feb7328cbd3561b7dbb1b01c2384f1ba4b6
  • cargo1.85-doc_1.85.0+dfsg3-1+tuxcare.els8_all.deb
    sha:eb88f38230785e1f8fdb4cfdd922242bdfada293
  • libstd-rust1.85-1.85_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:18180ccead985b36126d1a3975effcecf8d6b9d8
  • libstd-rust1.85-dev_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:a28dbb0f0937452828e4d323f0efcad47d9e7365
  • rust1.85-all_1.85.0+dfsg3-1+tuxcare.els8_all.deb
    sha:628ae6f6b4cbde64d08a2fc84e95ce2e5e79914c
  • rust1.85-analyzer_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:c784d80ea514240c592bac81c27bd8f37147affe
  • rust1.85-clippy_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:e071ab0fefdabc1ea54d6ac444efad33f0c051bf
  • rust1.85-doc_1.85.0+dfsg3-1+tuxcare.els8_all.deb
    sha:c5d27b44e7f8afea278748a7686b7a3ac20835ea
  • rust1.85-gdb_1.85.0+dfsg3-1+tuxcare.els8_all.deb
    sha:0787f56a1f80cb9c317d7d375ccc200666408d46
  • rust1.85-lldb_1.85.0+dfsg3-1+tuxcare.els8_all.deb
    sha:73cff71d79710766e5c00bed350fd8b3e11a8c4a
  • rust1.85-llvm_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:4d8fc9673762d3756e6a914c091e8069d31ad6bd
  • rust1.85-src_1.85.0+dfsg3-1+tuxcare.els8_all.deb
    sha:c85ef27446cc5e129898854da270ffbb5eb76371
  • rustc1.85_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:b19abe86535c7dd06c2cd6dd6e9f77b71f141603
  • rustfmt1.85_1.85.0+dfsg3-1+tuxcare.els8_amd64.deb
    sha:dcda985d58502457323acbf6c116ffe88e96940a
  • cargo1.85_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:da1bad904ef96de3d85fb53e0131a4dfc4b77e13
  • libstd-rust1.85-1.85_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:3fb0f4428940d3b40fb1a73b59fbaaae27479148
  • libstd-rust1.85-dev_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:8fd4d300b0bd6de639477b661d165072828c3604
  • rust1.85-analyzer_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:9fc70ee193ad581e882654c6dd42c10209b4d4f0
  • rust1.85-clippy_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:d8928c9b560b7a611357ec0224b74a4a83ae7c6d
  • rust1.85-llvm_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:f6f4e59b39886de3c3fdd7209093c22484a12da4
  • rustc1.85_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:d1de32be9ce65ba190dd8a7f39a0eb16fe45db94
  • rustfmt1.85_1.85.0+dfsg3-1+tuxcare.els8_arm64.deb
    sha:45d51843b22913fe9c4c17003e7bb9d40b031100
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.