[CLSA-2026:1790801536] Fix CVE(s): CVE-2026-5223
Type:
security
Severity:
Moderate
Release date:
2026-09-30 20:52:32 UTC
Description:
* SECURITY UPDATE: symlink extraction from crafted registry crate tarballs - debian/patches/cargo/CVE-2026-5223.patch: reject tar entries that are neither regular files nor directories in unpack_package() in src/tools/cargo/src/cargo/sources/registry/mod.rs so a hand-crafted .crate from an alternate registry cannot unpack symlinks - CVE-2026-5223
CVEs fixed:
Updated packages:
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:cd963d081e7bda22a462c17dd372819a2c07973d
  • cargo1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:8e5a305f6320c7fcc3747079ef1e9261c0bc49d4
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:e448ec5ed566511faa228b146b8cea258c36d4ee
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:81d6c4a58488e535bf597a6064f59101fb8cb030
  • rust1.87-all_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:9a30fd418f0d000c7c7bf44b902ced063dbe17a4
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:c6e88661ad174f2b88c50b655bf468bbde4c5803
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:74bf0aab75f6c2676ba2c93e88f1b9a64ee976f5
  • rust1.87-doc_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:39894e00ebd8edf489ffda5dab7c9b217e29f23b
  • rust1.87-gdb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:3ac9ab7535754adff77feec7afb7076b44e33f5f
  • rust1.87-lldb_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:df06738dced7c304c3f93bb7b17d7e0723cf93fb
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:12ea681d9b002f1ae57eb630fd22ab844ebc4a7e
  • rust1.87-src_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_all.deb
    sha:75e968f0165f588b9f794bb742eca405580f9496
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:ce74021a50a2aa064e7a61520294c76733f567ef
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_amd64.deb
    sha:0037d8e03f84d6924b03064664ef7d1959dce4c6
  • cargo1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:85979f3d62e2c2ebfc92e94ab65bd1f47adaf9ab
  • libstd-rust1.87-1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:fa0a60c01bb2e052501387bbc006c429d9ac1a0a
  • libstd-rust1.87-dev_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:dc3495ae59df9d3fac7294b8d336ed384297597f
  • rust1.87-analyzer_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:37fed7b82c9a711c8761423efdd8bf13ffef3983
  • rust1.87-clippy_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:021de57fd2575c57ac0b9f90f6ccb5c0a5631b3b
  • rust1.87-llvm_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:4ef48dacfbf6c46f57c004ce6120e47aafd31949
  • rustc1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:446c1c7e90ba9c7e1813ce63d40b532cff34f97a
  • rustfmt1.87_1.87.0+dfsg1-1~bpo13+2+tuxcare.els7_arm64.deb
    sha:912242b018ddee464606863026406b744c4a137c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.