[CLSA-2026:1791431930] Fix CVE(s): CVE-2026-5222
Type:
security
Severity:
Low
Release date:
2026-10-08 03:59:10 UTC
Description:
* SECURITY UPDATE: source confusion between sparse registry URLs differing only by .git - debian/patches/cargo/CVE-2026-5222.patch: restrict the GitHub lower-casing and the .git suffix stripping in CanonicalUrl::new to schemes without a + specifier in src/tools/cargo/src/cargo/util/canonical_url.rs so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same source - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:df34c5a1c9e450cbfaa292081cb5db6f658924af
  • cargo1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:475861446916230cf2c6aa9185871590d565b698
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:18751ec141f28645cc8af677f14fd7eea03bd5c9
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:96b9fcfb47a7ddfe6f83029fa592e66d584451e3
  • rust1.87-all_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:aebb77a8c7ca4883e8c7ecee30ec68042c381075
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:f20c3965df14d4f2641460939dcd8c8687fd1eb6
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:7b43c356bb40e7ff2fd6e14beaffd6c149e95e21
  • rust1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:f1dead9e42854c8cbe648a416fd407e75c23a28e
  • rust1.87-gdb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:8c3b373379c428f454e31240ceb5ff4b5ff132bc
  • rust1.87-lldb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:5e2e52435f295bd249bd6e8b4741d0bedb8c6a04
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:37d233ea745fb385d85a3d81d20d48514a032493
  • rust1.87-src_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:5fed478db9fce8468058d066c7484a1d16d4d5d1
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:690d49256b13fcc38d1c6a3f67fc0b96182aa59b
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:038dd88579d93642d8e963d3088491250e6ee147
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:32f30698692dee0b5516d06591ddb7fa2f5c9066
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:995cf82189def3bcb33d0002e7b16bdbcd85ecec
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:df34d331e3ffa3e635f5bc6d28b8f643c7d48783
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:db09627136b788c4561fc9213dbb6c0de5ac3f9b
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:e3f3e48c97adc521bf3d7e15e4befad120dab730
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:6bc9d7dda01d87858aec242aeb9bc7f644ec9791
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:640e9e849f9cf956ed12d3a0928f1c7e69558511
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:f26ed68b112d00bf782ca890ebbb4a78ebb3e62e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.