-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: rust-toolset:rhel8 security update
Advisory ID:       RHSA-2023:4635-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4635
Issue date:        2023-08-14
CVE Names:         CVE-2023-38497 
=====================================================================

1. Summary:

An update for the rust-toolset:rhel8 module is now available for Red Hat
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Rust Toolset provides the Rust programming language compiler rustc, the
cargo build tool and dependency manager, and required libraries.

Security Fix(es):

* rust-cargo: cargo does not respect the umask when extracting dependencies
(CVE-2023-38497)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2228038 - CVE-2023-38497 rust-cargo: cargo does not respect the umask when extracting dependencies

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.src.rpm

aarch64:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm

noarch:
rust-debugger-common-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
rust-gdb-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
rust-lldb-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
rust-src-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm

ppc64le:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm

s390x:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm

x86_64:
cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-38497
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk2ozbAAoJENzjgjWX9erEVpEP/0hiApFigMqLiLBLd5B6ktf4
ruTEx7AXpA9drO1BmkQEwJlp0Nlr5zbOzacV62rPc7AuxQh5EKpjKRRvUzew29Ae
j9tkEfpSPm1/qeY5cHtumaVDapdxY0zhe771sL0F99MxucpQkp3Okk+AK8gLC5nf
0lFmBmnWCcGa6ODIez6JJPx/ghzREYzeS0Gg9FlFDBm0pP3LXoVGOZpr5R6RCTWt
6BYyaYWWwYWU8Yu2P0p5cMO4X6sM5wPTUsmQyXVBcjFAsT9vUGMiY0v0JyeXHb2c
vrZekj6yXHVfmG3KlPbqRwosBkKY1IqWJXkiz5pKrZNNoy21uIqDjdU7ERLsGxMn
ZgozMGlkbBNch3Fx/EIhNyp+aY7QKipnTfCPTvPQ0ZC01T2lZkmjNe0k7OdqJz8g
ACLq4xz7SLhdH+xHPtSs7ARg6W9bcGvLQCrgXgJoVTf/L3LWbQ7AAFa3orSwZ8QX
Me8MadVJTKFZ6pq+MaOqKzqLnmkvpl+KqGYWpLKIC4hXKP87QNd870dNMBNyVgjG
CtoJxwl8FFwJba5GUc9EWXo+eSpv2kvcTEcTMtzJSiprdlFaFpwWC2OS6Tju5UNq
gfmcNGhgXoX8Z4QOH38gsHZTvg9BBYSIPG/XRKi2AGac2TfpHOwLG/AUW4oyUSvg
WzuJxXfhZZXj27mWAGnq
=ZDuF
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2023-4635:01 Important: rust-toolset:rhel8 security update

An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8

Summary

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.
Security Fix(es):
* rust-cargo: cargo does not respect the umask when extracting dependencies (CVE-2023-38497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2023-38497 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.src.rpm
aarch64: cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64.rpm
noarch: rust-debugger-common-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm rust-gdb-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm rust-lldb-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm rust-src-1.66.1-2.module+el8.8.0+19613+f0bba33b.noarch.rpm
ppc64le: cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le.rpm
s390x: cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x.rpm
x86_64: cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm cargo-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm clippy-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm clippy-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-analysis-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-analyzer-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-analyzer-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-debugsource-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-doc-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-std-static-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-std-static-wasm32-unknown-unknown-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-std-static-wasm32-wasi-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rust-toolset-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rustfmt-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm rustfmt-debuginfo-1.66.1-2.module+el8.8.0+19613+f0bba33b.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2023:4635-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4635
Issued Date: : 2023-08-14
CVE Names: CVE-2023-38497

Topic

An update for the rust-toolset:rhel8 module is now available for Red HatEnterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64


Bugs Fixed

2228038 - CVE-2023-38497 rust-cargo: cargo does not respect the umask when extracting dependencies


Related News

6.EmailConnection Touch Esm H320
2 - 3 min read
Recent security updates for Ubuntu and Debian have been released to address vulnerabilities in Thunderbird, the popular open-source mail and
30.Lock Globe Motherboard Esm H320
1 - 2 min read
As cybersecurity practitioners, we are no strangers to the constant threat of malicious actors and the importance of remaining vigilant to protect
22.Lock ScreenEffect Esm H320
1 - 2 min read
EndeavorOS Gemini is a captivating and charming desktop operating system based on Arch Linux. The new release includes a kernel upgrade, 3D graphics
25.@Sign Hook Keyboard Esm H320
1 min read
Cyber risk is increasing for individuals and organizations, making flexible and robust solutions for identifying spam and malware increasingly
19.Laptop Bed Esm H320
2 - 3 min read
The recently released Linux Kernel 6.9 brings forth a blend of crucial upgrades and enhancements, catering to the ever-evolving needs of the Linux
4.Lock AbstractDigital Esm H320
1 - 2 min read
Nmap 7.95 introduces myriad enhancements, primarily focusing on OS and service detection signatures. This reflects the dedication of the Nmap
5.ShakingHands Esm H320
3 - 5 min read
There has been a promising shift in the tech industry, with major companies pledging to release products with built-in security features. This
18.WifiCutout Landscape Esm H320
2 - 3 min read
A novel attack called TunnelVision has been discovered. It compromises the security of virtually all VPN apps, rendering their purpose useless. The

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved