The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.

This update for rust fixes the following issues :

Rust was updated to version 1.36.0.

Security issues fixed :

CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)

CVE-2018-1000622: rustdoc loads plugins from world-writable directory allowing for arbitrary code execution (bsc#1100691)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rust fixes the following issues :

Rust was updated to version 1.36.0.

Security issues fixed :

  - CVE-2019-12083: a standard method can be overridden     violating Rust's safety guarantees and causing memory     unsafety (bsc#1134978)

  - CVE-2018-1000622: rustdoc loads plugins from     world-writable directory allowing for arbitrary code     execution (bsc#1100691)

This update was imported from the SUSE:SLE-15:Update update project.

This update for rust fixes the following issues :

Rust was updated to version 1.36.0.

Security issues fixed :

  - CVE-2019-12083: a standard method can be overridden     violating Rust's safety guarantees and causing memory     unsafety (bsc#1134978)

  - CVE-2018-1000622: rustdoc loads plugins from     world-writable directory allowing for arbitrary code     execution (bsc#1100691)

This update was imported from SUSE:SLE-15:Update.

This update for rust fixes the following issues :

  - CVE-2018-1000622: rustdoc loads plugins from     world-writable directory allowing for arbitrary code     execution This patch consists of requiring     `--plugin-path` to be passed whenever `--plugin` is     passed Note that rustdoc plugins will be removed     entirely on 1.28.0 (bsc#1100691).

This update was imported from the SUSE:SLE-15:Update update project.

Update to 1.27.1. Security fix for CVE-2018-1000622

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rust fixes the following issues :

CVE-2018-1000622: rustdoc loads plugins from world-writable directory allowing for arbitrary code execution This patch consists of requiring `--plugin-path` to be passed whenever `--plugin` is passed Note that rustdoc plugins will be removed entirely on 1.28.0 (bsc#1100691).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201812-11 (Rust: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Rust. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker able to control the value passed to Rust&rsquo;s       str::repeat function could possibly cause a Denial of Service condition.
    In addition, a local attacker could trick another user into executing       arbitrary code when using rustdoc.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
130198	SUSE SLED15 / SLES15 Security Update : rust (SUSE-SU-2019:2755-1)	Nessus	SuSE Local Security Checks	high
129743	openSUSE Security Update : rust (openSUSE-2019-2294)	Nessus	SuSE Local Security Checks	high
129579	openSUSE Security Update : rust (openSUSE-2019-2244)	Nessus	SuSE Local Security Checks	high
129455	openSUSE Security Update : rust (openSUSE-2019-2203)	Nessus	SuSE Local Security Checks	high
129400	openSUSE Security Update : rust (openSUSE-2019-2201)	Nessus	SuSE Local Security Checks	high
129287	SUSE SLED15 / SLES15 Security Update : rust (SUSE-SU-2019:2439-1)	Nessus	SuSE Local Security Checks	high
123355	openSUSE Security Update : rust (openSUSE-2019-851)	Nessus	SuSE Local Security Checks	high
120391	Fedora 28 : rust (2018-499d74c768)	Nessus	Fedora Local Security Checks	high
120142	SUSE SLED15 / SLES15 Security Update : rust (SUSE-SU-2018:3357-1)	Nessus	SuSE Local Security Checks	high
119945	GLSA-201812-11 : Rust: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
118449	openSUSE Security Update : rust (openSUSE-2018-1279)	Nessus	SuSE Local Security Checks	high
111249	Fedora 27 : rust (2018-f38d1cb219)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-1000622

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical

high

high