[CLSA-2026:1791432287] Fix CVE(s): CVE-2026-5222
Type:
security
Severity:
Low
Release date:
2026-10-08 04:05:06 UTC
Description:
* SECURITY UPDATE: source confusion between sparse registry URLs differing only by .git - debian/patches/cargo/CVE-2026-5222.patch: restrict the GitHub lower-casing and the .git suffix stripping in CanonicalUrl::new to schemes without a + specifier in src/tools/cargo/src/cargo/util/canonical_url.rs so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same source - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:940446cc7ab8a5b929daca5e996ecda7ff3d8397
  • cargo1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:e5d620ce2c7ea6ca995bb2b2187bf50d50e2bcb3
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:b408c36a14ac75dce9974b2f9bb39b309e709638
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:3e9c900075b0ca6473fcc56edbcb18461273af10
  • rust1.87-all_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:4bcad736dbacd2fbdfac339afd2112fff3f4e6f6
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:154792357fba01beb9f2581d55d06e9fe8987752
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:2299b2b780d2479f6d2faa8d8fce33515e167649
  • rust1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:d81c1864dfa304ccb5a19d838ea323f97810b77c
  • rust1.87-gdb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:854453f04eb5759479bc8ea875e197e753bdd62c
  • rust1.87-lldb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:8fb79da2f2cd53515f455493f6b45ea9f8e36423
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:50d0ab8f95ef2a4d049fbe390cdb05eee15aed9c
  • rust1.87-src_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:9537529d72c8d31f8b200038ab1bab1cd05c6801
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:16df191b1e11a0ccfade635dc28fb6d0ccb518cc
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:e2821fd36898c6fe86b2a3cca1e9d22fb96e6795
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:757904f0ca1db4c6e9bcf3e6b1b29477bcfe307e
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:6500d83e8b19d2b9ed60f903ca9b7260a574d4c3
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:d049a66f41abbc229a31bd7ef778c528079240dd
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:b9b59aa9069a855f56dcf5d72881d26c424297bc
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:f2b3bdf2df83983f7d85649fc1356861c2b9a54f
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:2bb1520f6b842a16952eb4ce7d7a65563dff68a5
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:8eb4554a6814357fcb881c41372140405a5058af
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:978c43f5b5b9545d5aa22cb89517cec13903f2a0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.