[CLSA-2026:1791195932] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-10-05 10:25:49 UTC
Description:
* SECURITY UPDATE: cargo unpacks symlinks and other unexpected entry types from registry archives - debian/patches/CVE-2026-5223.patch: reject any entry that is not a regular file or a directory when unpacking a .crate in src/tools/cargo/src/cargo/sources/registry/mod.rs, so a hand-built archive from an alternate registry can no longer place a symlink in the registry source cache - CVE-2026-5223 * SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:28c756a473b11dfb1d06e01d59fe4559a0d4fff5
  • cargo1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:575f7017fde37a1bc15f42b8285876bd7e3794d2
  • libstd-rust1.88-1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:86ca292a8260236f946432c43fb93a634468a972
  • libstd-rust1.88-dev_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:80f14ab73feeeafa64ab67222ab3357f63e960b3
  • rust1.88-all_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:690481072708b273432ac56579c7e817e05efa49
  • rust1.88-analyzer_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:793eebf4870e2af3d0b4c3b5761d71cfd96d85c6
  • rust1.88-clippy_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:cea64a2740facfd1fa914dcfd06c7cf5490c0499
  • rust1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:89a7d43620c305c54eeda48c0afb7ecdc3876a9f
  • rust1.88-gdb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:3ebe8f33555008cbb8f0622f2796ba851278fe64
  • rust1.88-lldb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:37c3b0d17d00c99706604419d8ac95318d0a3d7d
  • rust1.88-llvm_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:23d9d99e5b05da5ec84f7077d96b58cc1923639f
  • rust1.88-src_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_all.deb
    sha:1396dca7691d42a3d07cdb2391c42ba50e4b0b8f
  • rustc1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:9ee56bd56518219b0bc48c135998a9f73a346633
  • rustfmt1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_amd64.deb
    sha:7121b55d5e42084f46461ecfac8957d23c1946bc
  • cargo1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:7a0be2f47f6eeb82d471b4dbfe24b0b308d9ba84
  • libstd-rust1.88-1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:bb5cad43f512e6c02cc21149c2ba200bcd23257a
  • libstd-rust1.88-dev_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:83b1e55a88d5dd05a6b757c6501249859ad46a2f
  • rust1.88-analyzer_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:b389bbcb814171f9e9ff0b736a009b19c4ae469e
  • rust1.88-clippy_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:451d76c81600ddbc354be2afa7a3d4e72fa0de12
  • rust1.88-llvm_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:8067b7c3af6a5aa42420fc600d2f4134fe160294
  • rustc1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:ec82170cf8c21295c4450021d9022b982f030c96
  • rustfmt1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els7_arm64.deb
    sha:d8d14a610a22df50b58a686a832eb4e7ff932a8a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.