[CLSA-2026:1790770322] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 12:12:19 UTC
Description:
* SECURITY UPDATE: cargo unpacks symlinks and other unexpected entry types from registry archives - debian/patches/CVE-2026-5223.patch: reject any entry that is not a regular file or a directory when unpacking a .crate in src/tools/cargo/src/cargo/sources/registry/mod.rs, so a hand-built archive from an alternate registry can no longer place a symlink in the registry source cache - CVE-2026-5223 * SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:c9a4281db12ef369be04ee1194b13fde315b25b2
  • cargo1.89-doc_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:77e69b276cc8a88540935c900f32f52c61d08202
  • libstd-rust1.89-1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:cfa5ef0a3843197cdd30d766b058d49ae8ec1a90
  • libstd-rust1.89-dev_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:6422dce055e6c4f16133d41d3de722f117133e44
  • rust1.89-all_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:4345bdd04fbd824e07bfec17b9886c2dc4b8d5c6
  • rust1.89-analyzer_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:12d5625286376e9a16fa8dbf037645973a3757d7
  • rust1.89-clippy_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:4e2325fdd090e0e9ee43a251fe200deb7d0b9ff2
  • rust1.89-doc_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:1d92496afed77edba3f4606e4d4157377ab4ee3c
  • rust1.89-gdb_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:bfb08f36d5dbf4426318671bbf8032e634a84a1b
  • rust1.89-lldb_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:a382c4658c8419da03944a2a2f3a63589514133c
  • rust1.89-llvm_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:0a6cf1fe89b8b87dddf0902edb2a6a0ac2fe1a6e
  • rust1.89-src_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:bbb3a52e3cadf8a1ac9fe852256092b2f03b6c22
  • rustc1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:856c62778b6695bc2cf091dbf2b94234e8726c75
  • rustfmt1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:5791166a7295e1c58bbdebba266fd0888397afb6
  • cargo1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:8ec5e5c053d89c082d732d402076924966fb1680
  • libstd-rust1.89-1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:9ce07d43462d0206bcb87247d4b8e4ce4bbac1c2
  • libstd-rust1.89-dev_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:107e53254bc906ca79ffdbc64cb57011792f58d4
  • rust1.89-analyzer_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:9d925c96bed01be2757a2297926a1688000c82a1
  • rust1.89-clippy_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:da5ac2e717c05c84bc5957ace9a7f834b97fd2c8
  • rust1.89-llvm_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:db28a39791a5fa2ab345a6ae1deb1a59cb77e166
  • rustc1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:6a8df2d21d01445d50bbec20fc0acb879dcb4be0
  • rustfmt1.89_1.89.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:0793dc4399f46e943fd3d222cc9f65344377278f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.