[CLSA-2026:1790786439] Fix CVE(s): CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 16:40:55 UTC
Description:
* SECURITY UPDATE: Symlink extraction from crate tarballs in cargo - debian/patches/upstream/CVE-2026-5223.patch: abort the unpack on any tar entry that is neither a regular file nor a directory in RegistrySource::unpack_package, so a crafted .crate from an alternate registry can no longer plant a symlink that redirects later writes into a sibling crate's registry cache - CVE-2026-5223
CVEs fixed:
Updated packages:
  • cargo1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:ed8cd9fdfdd1fa8d85b80e54901f0b8cb291da05
  • cargo1.85-doc_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:682cccc9ce60786f4aff882ba8e7fa5cb7c67879
  • libstd-rust1.85-1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:21bbd5a602dcbed8a1a40d16d7c01581af15d78a
  • libstd-rust1.85-dev_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:db8c70b3e403432590a1605a8746ee13f803cf6d
  • rust1.85-all_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:41945a9eb2844edf1573205a75807323c69614af
  • rust1.85-analyzer_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:a2cd867e8010dfc269dcde494161d41c812571ac
  • rust1.85-clippy_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:bca8ada7876a8246b7c1ab643277882f1676d690
  • rust1.85-doc_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:5da941a4f7f27fd0ab25f0f0e759f142ceb9cad6
  • rust1.85-gdb_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:15d3b69d83bbed992a28ff8b4eff5d4e19b29a85
  • rust1.85-lldb_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:e3faa26cc4d7e0075f9283370d64d8d24f26439e
  • rust1.85-llvm_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:abaac345874e01f95cbec0ef374547eff69d1482
  • rust1.85-src_1.85.0+dfsg3-1+tuxcare.els7_all.deb
    sha:d10456165a9350140f0b976ce13bd9e7ee3f92d3
  • rustc1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:639e1614e6e5f0c8c48d6188d6e2cdc6a3e39e85
  • rustfmt1.85_1.85.0+dfsg3-1+tuxcare.els7_amd64.deb
    sha:6acf6b131f5d9b769ef9ccb4a8143c696c3e9897
  • cargo1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:8d12ac1b7f8e52fa4d9f8de58d7048c9cb035ae5
  • libstd-rust1.85-1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:de3b1f6ea3379a5ff6412dc4fe5863e8b69917ca
  • libstd-rust1.85-dev_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:3acce7f2c4f655f95b1638a948432c12f02ab9c7
  • rust1.85-analyzer_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:52d40e4385f9b45acfd81afc46acf939635a90c6
  • rust1.85-clippy_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:7cd7d89d34701e0a02788495155441029eb61b99
  • rust1.85-llvm_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:fd304e17cfd4bcaacc849263d9fc73145d202c0e
  • rustc1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:6141ce6a3c9ba9c7da0dc31af8a2b73c358ec62e
  • rustfmt1.85_1.85.0+dfsg3-1+tuxcare.els7_arm64.deb
    sha:359d93092e09e73afe6a15c21cd14e61c210a42c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.