[CLSA-2026:1790784990] Fix CVE(s): CVE-2026-5222, CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 16:16:46 UTC
Description:
* SECURITY UPDATE: credential scope confusion between sparse registry URLs differing only by a .git suffix - debian/patches/CVE-2026-5222.patch: skip the GitHub lower-casing and the .git-suffix stripping in CanonicalUrl::new when the URL scheme contains a '+', so sparse+https://host/index and sparse+https://host/index.git no longer canonicalize to the same registry and share credentials - CVE-2026-5222
CVEs fixed:
Updated packages:
  • cargo1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:bc61bc7661af97702d1350d87cea9d8dedb29c4f
  • cargo1.86-doc_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:c8eca6fb5c32da375bad2557016a70c8786ecc52
  • libstd-rust1.86-1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:f18b5e95b85e15b4b2e97c9570b54065227dc194
  • libstd-rust1.86-dev_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:c94293b1307b59da26265f7e9fcb5798e0df7d67
  • rust1.86-all_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:425d0e7cafec1c371ebfe5d83deb35626b4b0696
  • rust1.86-analyzer_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:4f36f78e0dbb187ac541a48b8fa78b20311805a6
  • rust1.86-clippy_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:19ee6e832bf554f4c86442b42306a44f96ba3c9d
  • rust1.86-doc_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:6c790a09d1cb5b063cc8d1798f0bd1dbb7f8df81
  • rust1.86-gdb_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:3192e5c9d0a1ba7ad4a38c4d5b87ee96b8e1a56f
  • rust1.86-lldb_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:918255a41d77f4a1f4751ff7829a4c653463f608
  • rust1.86-llvm_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:61e0f8d2c1fc7e05b0ebd8f4557399aac8e545c3
  • rust1.86-src_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:13c06a4d5459d498cae0f583ab666f4f983dad6d
  • rustc1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:e598c04f75429f280c724701e5438f934911f95c
  • rustfmt1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:c78f804974fe7d8d4e0f7fd609c3c86f5d3079ad
  • cargo1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:0af2080b63390ee920afeff9da64cb46ad76a6fc
  • libstd-rust1.86-1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:8ebc5c527bb6fdd3a046e13b61a783d6c4a87ee9
  • libstd-rust1.86-dev_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:5cc16f1620a3444d2cd62469840cffa816eb3993
  • rust1.86-analyzer_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:7bab645f53b29a98f97f7b0770dbd6a42d372fc6
  • rust1.86-clippy_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:e083bbe4faa45ca5c1ab40d2d32a98f8c6356c0b
  • rust1.86-llvm_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:c368ac816df93096aefdd533dc4c1157f3c5c8ea
  • rustc1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:975dc2c53997502cd18af1d2404d0da6cd25748d
  • rustfmt1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:07c28a10d4c4cd5f7e10b16c6aedd1470320bad0
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.