[CLSA-2026:1790769075] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 11:51:31 UTC
Description:
* SECURITY UPDATE: cargo unpacks symlinks and other unexpected entry types from registry archives - debian/patches/CVE-2026-5223.patch: reject any entry that is not a regular file or a directory when unpacking a .crate in src/tools/cargo/src/cargo/sources/registry/mod.rs, so a hand-built archive from an alternate registry can no longer place a symlink in the registry source cache - CVE-2026-5223 * SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:e1030e16673b11bc4a79edb2edf2e39495081b09
  • cargo1.89-doc_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:b25d018e2e8bac55e7175d73d65cf171998cf702
  • libstd-rust1.89-1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:03d83273cc08ff782706a80ace08c16eece86fcf
  • libstd-rust1.89-dev_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:487eba699eddf47a9fe5dc18eb0851cddb042f19
  • rust1.89-all_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:3deea34757338aa5633d8d29d49a2ffd5faeb9e9
  • rust1.89-analyzer_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:cac5644584420e1650678855fffa7a4a02b909e0
  • rust1.89-clippy_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:5252f69dd786e34969b3194d77df6a2718b83b0c
  • rust1.89-doc_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:ec55da0edf7ca473992fe4ca9365fd63c6af9299
  • rust1.89-gdb_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:69acfaed998fa4cc925be0b3edcb02fa954fcfb1
  • rust1.89-lldb_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:e308b0ee0df58dbe1cc8823a424854315262093e
  • rust1.89-llvm_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:21478ba333d4e696d941fcd66c9652bfcedbd1dd
  • rust1.89-src_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:77a5a5b3b5c438181c81f74fa5dce85f0db2331e
  • rustc1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:d09875a08257967ead29fbfb7b955dc126d6f2ec
  • rustfmt1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:f6bb10efd6a25ab93ff431252f84a5e2212d1538
  • cargo1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:1a384ef1e3383ab5dbc4d6876c99da0eb116032d
  • libstd-rust1.89-1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:0156ca782a27d90ec9a31f0e23240685a46c01e0
  • libstd-rust1.89-dev_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:44739f42fc67b6b3ee68bb725ee0a72ad22ff15a
  • rust1.89-analyzer_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:161a8c08fcc9fe0898e62ebe643115a899c889a5
  • rust1.89-clippy_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:7a478450a900d67ed15250dd65776e469fa1ac85
  • rust1.89-llvm_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:5913949d61f85d2f5d5f6379565f5139c2f08107
  • rustc1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:bbaf4afbf3e8a2b3ee99bd771f3a5f6b3325e5fb
  • rustfmt1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:64d0c221ca8186460422389a52e2dbcbeb33908d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.