[CLSA-2026:1790799352] Fix CVE(s): CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 20:16:06 UTC
Description:
* SECURITY UPDATE: symlink extraction from crafted registry crate tarballs - debian/patches/cargo/CVE-2026-5223.patch: reject tar entries that are neither regular files nor directories in unpack_package() in src/tools/cargo/src/cargo/sources/registry/mod.rs so a hand-crafted .crate from an alternate registry cannot unpack symlinks - CVE-2026-5223
CVEs fixed:
Updated packages:
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:72304dcc5cc9b9521efcff188d3b7d622944df72
  • cargo1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:b3c96a74a66a3064896ff8eec3cb6a1af526e7ec
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:e147ca68516dd159ad53dc65fcf85e77934896d4
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:b1f4111f08f0ce671a6209480bb2185be8c6e29a
  • rust1.87-all_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:5c1c20e46cb85b02236c69dbdf96c55b36064ec7
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:2e97691af9461edff0ab29c058053cc27a59d1e6
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:8d02a184cd194f1762050ec030a36b00a39ea47a
  • rust1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:ab89c37714a931a1973684adb3c0142758495333
  • rust1.87-gdb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:ca4760c7bdeb0bc73b540accbe101fdd45458bb3
  • rust1.87-lldb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:cfbf9043c6381b1e0b9a511774f4efa55644bab6
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:0e43b48ad7abf0f2530f2147eb9d6e4bdd785b75
  • rust1.87-src_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:a2740d52cfefe48acf03f86d30e75c564f663611
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:e5861eae8750c7bd004d2ee240bed3fdae439c99
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:702e82ddde46fba533e3853db6312f52b7401434
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:ab6f71dada66416c12cbce59b0201203ee6f24cb
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:57feb583afcacc8da49920817c2e4af555c05474
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:e37b9290444f55d24bed85abd501a18f1af5d6d7
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:75a623fecb610ef4d56b42b77b0f777da247bd58
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:844d9697f5a1d40b4b886e821722dcf3b0552109
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:d58c4178adb01101f2e15fb81050ec0f66336912
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:43585a5897458d14a23d18b8e03f39fde65dbc1d
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:2a146c5b9534121c6571beff4d86a55b92ec2ee6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.