[CLSA-2026:1791194889] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-10-05 10:08:27 UTC
Description:
* SECURITY UPDATE: cargo unpacks symlinks and other unexpected entry types from registry archives - debian/patches/CVE-2026-5223.patch: reject any entry that is not a regular file or a directory when unpacking a .crate in src/tools/cargo/src/cargo/sources/registry/mod.rs, so a hand-built archive from an alternate registry can no longer place a symlink in the registry source cache - CVE-2026-5223 * SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:9928cd83ceb97923820255ef51895755c9530122
  • cargo1.9-doc_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:aef44f1b7e3cadc807f3ce7d0f173d72aab3bcad
  • libstd-rust1.9-1.90_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:595b4fd790ca7cb1180115fc018e502a90475cb3
  • libstd-rust1.9-dev_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:2168cffdd343a2b852112693eb5f94c56594b962
  • rust1.9-all_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:c9b42ed2ac12443cb837889571522a50ce018782
  • rust1.9-analyzer_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:07e239480e600a9eeda5320eaa01337368f78cff
  • rust1.9-clippy_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:ee9d6746341f1c67d47c909a6869e89081c1286f
  • rust1.9-doc_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:8e04ab2940db470cb8270411701273a4de17df0f
  • rust1.9-gdb_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:89779ecc3ff2b64b2236f74566d3e2f13612f5f2
  • rust1.9-lldb_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:73e8257a7179e0f094f24559fe6080f495eee0c2
  • rust1.9-llvm_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:4fa8dbfeb51f126ca6e667124a85028ac2162796
  • rust1.9-src_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:9fdd70f935300710d11500bbc6ea9758a6e599ad
  • rustc1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:7bbeacc047583690f8c5def9d8b72d0fa3a0620a
  • rustfmt1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:b729de97a7bbd568f36ee4be5dbeefb3f3e73247
  • cargo1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:8d3ca18b91e58830ff1891c1ef4c7d160464b0d1
  • libstd-rust1.9-1.90_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:c187bee43d51b305be98aaeda3e3bb93579e66a5
  • libstd-rust1.9-dev_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:f89a1afd53fadfc4000e9dd0cad6786f9c72cb87
  • rust1.9-analyzer_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:5c9b461efec958e690bc495d0ee31e636875d6bc
  • rust1.9-clippy_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:87192c48a65e439916e9f4b06de804bb9d593fcc
  • rust1.9-llvm_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:5cb1fee0c9b45a70e7771ee6b5bba406fc0b1436
  • rustc1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:4fa515af3c106571616ff846fe6d5312b44d61c8
  • rustfmt1.9_1.90.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:88b4dc9cc26a74932489a9135586659b90840c65
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.