{"id":105101,"date":"2022-09-15T09:36:58","date_gmt":"2022-09-15T07:36:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust"},"modified":"2022-09-15T09:36:58","modified_gmt":"2022-09-15T07:36:58","slug":"uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","title":{"rendered":"Vulnerabilities in the Cargo package manager used for Rust projects","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Cargo package manager, used for managing packages and building projects in Rust, has been found to have two vulnerabilities that could be exploited when downloading specially crafted packages from third-party repositories (it is claimed that users of the official crates.io repository are not affected by this issue). The first vulnerability (CVE-2022-36113) allows overwriting the first two bytes of any file, depending on the current permissions. The second vulnerability (CVE-2022-36114) could be used to exhaust available disk space. <\/p>\n
The vulnerabilities will be addressed in the Rust 1.64 release scheduled for September 22. They have been assigned a low severity level, as similar damage when using unverified packages from third-party repositories can be caused by the default ability to run custom handlers from the included build scripts or procedural macros. In this case, the above-mentioned issues differ in that their exploitation occurs during the package unpacking stage after downloading (without building). <\/p>\n
In particular, after downloading the package, cargo extracts its contents into the ~\/.cargo directory and saves a successful extraction indicator in the .cargo-ok file. The essence of the first vulnerability is that the package creator can place a symbolic link named .cargo-ok inside, which will lead to writing the text 'ok' into the file that the link points to. <\/p>\n
The second vulnerability arises from the lack of restriction on the size of data extracted from the archive, which can be exploited to create 'zip bombs' (the archive can contain data that achieves the maximum compression level for the zip format \u2014 about 28 million times, meaning that, for instance, a specially crafted 10 MB zip file can unpack to approximately 281 TB of data). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"