Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CVE-2023-38497 for master #12443

Merged
merged 3 commits into from
Aug 3, 2023
Merged

Fix CVE-2023-38497 for master #12443

merged 3 commits into from
Aug 3, 2023

Commits on Aug 3, 2023

  1. test: verify permissions bits are preserved when unpacking 

    This is not secure and will be fixed in the next commit.
    @weihanglo
    weihanglo committed Aug 3, 2023
    Configuration menu
    Copy the full SHA
    789a2fb View commit details
    Browse the repository at this point in the history

  2. fix: respect umask when unpacking .crate files 

    Without this, an attacker can leverage globally writable files buried
in the `.crate` file. After a user downloaded and unpacked the file,
the attacker can then write malicous code to the downloaded sources.
    @weihanglo
    weihanglo committed Aug 3, 2023
    Configuration menu
    Copy the full SHA
    4fafa69 View commit details
    Browse the repository at this point in the history

  3. fix: clear cache for old .cargo-ok format 

    In 1.71, `.cargo-ok` changed to contain a JSON `{ v: 1 }` to indicate
the version of it. A failure of parsing will result in a heavy-hammer
approach that unpacks the `.crate` file again. This is in response to a
security issue that the unpacking didn't respect umask on Unix systems.
    @weihanglo
    weihanglo committed Aug 3, 2023
    Configuration menu
    Copy the full SHA
    c60c065 View commit details
    Browse the repository at this point in the history