[CLSA-2026:1790786078] Fix CVE(s): CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 16:34:54 UTC
Description:
* SECURITY UPDATE: Symlink extraction from crate tarballs in cargo - debian/patches/upstream/CVE-2026-5223.patch: abort the unpack on any tar entry that is neither a regular file nor a directory in RegistrySource::unpack_package, so a crafted .crate from an alternate registry can no longer plant a symlink that redirects later writes into a sibling crate's registry cache - CVE-2026-5223
CVEs fixed:
Updated packages:
  • cargo1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:9415f7a70b707b47fce916d9a82e14e3610645e1
  • cargo1.85-doc_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:d3100b851f3131f86f116ce59fdd18fbfdfa9b5c
  • libstd-rust1.85-1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:07580b62ab5a31a9dfc3c78101613893b487c145
  • libstd-rust1.85-dev_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:ee52d20dbf2de5cea8f37d046ea2c94a36ae3f49
  • rust1.85-all_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:689cef387481ce1a57cc6122c413fc490a958868
  • rust1.85-analyzer_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:465bacd6cabd3e31bcc735cef3db9d3ba239f4f4
  • rust1.85-clippy_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:5f303d4d1997ea2d1a1abf3e8286b77e10abe622
  • rust1.85-doc_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:01eafb01013c68deba386a6f59529316ee77a259
  • rust1.85-gdb_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:904aa8438dd38b0c80b6d3d6f96c9d6a100235f2
  • rust1.85-lldb_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:c4ca1c2d3e75798a1c1e841449895d3c8edb4154
  • rust1.85-llvm_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:5faecec71119f2101a6df1618e71d5570bc8abf8
  • rust1.85-src_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:c338d0a0398ea599e90b1f2c72b72e4088d691fd
  • rustc1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:eb741bcc1806608c23ae650822925a99b47d76b5
  • rustfmt1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:789e03196b3082c19a34e59e8626f55c49e6c36d
  • cargo1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:9348af46cf29e35c1e845bd0bcb04234d044e5ec
  • libstd-rust1.85-1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:914f522075487dcb3300754eedfa1e19d1106fc4
  • libstd-rust1.85-dev_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:87be471f62cc7f1333cfe39ff7daa553edc8988c
  • rust1.85-analyzer_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:64bf9dd79a33763c9b82d0d90a658fc7fb7d1611
  • rust1.85-clippy_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:4ee5b2903e08db64f5fb51516425fa774636f57d
  • rust1.85-llvm_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:72a86f3314a3cfecb6ff1a3e210d22338e67da22
  • rustc1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:7ce74e47328670784d60ef2dc0f081498f41d3a8
  • rustfmt1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:1a3f0d3267d260fad73bcd1e72f684a7ebfe4ca5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.