SUSE SLES15 Security Update : rustup (SUSE-SU-2026:2831-1)

critical Nessus Plugin ID 326333

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2831-1 advisory.

This update for rustup fixes the following issues

Security issues:

- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust- openssl crate (bsc#1270874).
- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
- rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Non security issue:

- devel:languages:rust/rustup: Missing symlink for rust-analyzer (bsc#1203257).

Changes for rustup:

- Completely drop openssl to prevent future security issues

Update to version 1.28.2~0:

* Deprecate native-tls as well
* Enable HTTP/2 support for reqwest download backend
* Emit tracing events from log facade calls
* download: show Debug representation for errors
* Avoid repeated globals in tracing events
* Log original download errors immediately
* feat(cli/rustup-mode): add aliases to `rustup component remove`
* Switch flate2 to use the zlib-rs backend
* Hardlink proxies if symlinks aren't reachable
* Add powerpc64le-unknown-linux-musl support
* Add toolchain_name to not installed bail msg
* Warn about using curl
* Drop workspace indirection
* Fold download crate back into rustup
* download: merge integration test files
* chore(deps): lock file maintenance
* Test CARGO environment replacement
* Update CARGO env var if it is a rustup proxy
* Tweak toolchain subcommand help text
* Move toolchain and default commands first
* show toolchain paths in rustup show -v output
* refactor(cli/self-update): save allocations in `Nu::rcfiles()`
* fix(cli/self-update)!: stop appending to `env.nu` due to deprecation
* fix(cli/self-update): consider Windows paths in Nushell suggestions
* refactor(cli/self-update): use `path add` in `env.nu` template
* fix(cli/self-update): use interpolated string in `env.nu` template
* Upgrade dependencies
* docs(user-guide/environment-variables): document `RUSTUP_VERSION`
* feat(rustup-init/sh): allow setting `RUSTUP_VERSION` during installation
* feat(cli/self-update): allow setting `RUSTUP_VERSION` for arbitrary downgrades
* feat(test/clitools): add `Config::expect_ok_ex_env()`
* fix(errors)!: improve error messages for `RustupError::ToolchainNotInstalled`
* Add set auto-install disable
* Use `cursor: pointer` for copy button on website
* fix(dist): refine suggestions about missing targets
* Append Windows bin directory to PATH by default
* Remove validation for custom toolchains when reading rust-toolchain.toml
* document RUSTUP_AUTO_INSTALL
* Fix build script `cargo` instructions

Update to version 1.28.1~0:

* dist(rustup-init/sh): update commit shasum
* Update changelog for 1.28.1
* fix!(config): re-enable implicit toolchain installation in `Cfg::local_toolchain()` with optional opt- out
* refactor(test/clitools): extract `Config::expect_err_env()`
* Use relative symlinks when possible
* docs: update CHANGELOG for v1.28.1 release
* fix!(config): re-enable active toolchain installation in `Cfg::find_active_toolchain()` with optional opt-out
* config: make Config::find_active_toolchain() async
* Use terse output for rustup show active-toolchain
* Use read_timeout for reqwest instead of timeout
* test: turn set_current_dist_date() into a Config method
* test: privatize clitools module
* test: remove function wrappers for cmd() and env()
* test: privatize mock module
* test: move create_mock_dist_server() to Scenario::write_to()
* test: move Release into dist
* test: turn channel builders into constructors
* test: move mock channel builders into dist
* test: move arch consts into top-level module
* test: turn build_*_installer() functions into constructors
* test: move installer builders into mock module
* test: privatize items in clitools
* test: keep Config impl close to type definition
* test: privatize dist module
* test: privatize items in test::dist
* test: inline short module topical_doc_data
* Remove level of nesting in test module
* Tweak SanitizedOutput style
* docs: update `CHANGELOG` for v1.28.0 release
* Have mocked cargo better adhere to cargo conventions
* Do not append `EXE_SUFFIX` in `Config::cmd`
* Add `TryFrom<Output>` for `SanitizedOutput`
* refactor(test): replace `(before|after)_test_async()` with `TestProcess::_telemetry_guard`
* style(rustup-init): reorganize imports
* refactor(log): introduce `GlobalTelemetryGuard`
* refactor(process): rename `TestProcess::_guard` to `_tracing_guard`
* chore(deps): update opentelemetry
* fix(deps): update rust crate windows-registry to 0.5.0
* refactor: improve binary suffix stripping
* build: bump the codebase Language Edition to 2024
* style(cli/job): fix `unsafe-op-in-unsafe-fn`
* style(cli/log): use precise capturing when necessary
* chore: use unsafe versions of `(add|remove)_var()`
* style: remove redundant `ref` keywords
* style: partially migrate away from `if-let`
* style: format sources with the 2024 Style Edition
* chore: fix new `clippy` warnings
* fix(deps): update rust crate pulldown-cmark to 0.13
* feat(rustup-init/sh): add env var to print arch detection result
* refactor(component): reduce allocations in `ComponentPart::encode()`
* refactor(component)!: extract `ComponentPartKind`
* style(component): reduce right drift in `ComponentPart::decode()`
* refactor(component)!: turn `ComponentPart`'s fields into named ones
* fix(dist/prefix): normalize path separators in `REL_MANIFEST_DIR`
* fix(component): normalize path separators during `ComponentPart::(en|de)code()`
* Upgrade to rand 0.9
* fix(ci/doc): fix typo in renovate `datasource`
* ci(doc): make `renovatebot` bump locked `mdbook`
* ci(doc): pin `mdbook` to `0.4.43`
* ci(schedule): run cron tasks more times per week
* ci(schedule): promote to use the `stable` job list
* ci(doc): fix stable build of `user-guide`
* ci(linux): enable the full test suite for `aarch64-unknown-linux-gnu`
* ci(linux): use public ARM64 Linux runners
* ci(deploy-docs): merge with `test-docs`
* ci(deploy-docs): enable on PR without uploads
* ci(deploy-docs): build one book per workflow step
* ci(deploy-docs): install `mdbook` with `install-action`
* Change installation of dependencies for Aarch64 Dockerfile
* Run Aarch64 jobs on PRs
* Use ARM based runners for ARM CI targets
* style: fix `clippy` warnings
* docs(user-guide/components): add deprecation notice for `wasm32-wasi`
* Update Windows dependencies
* feat(cli/rustup-mode)!: simplify error message for `rustup show active-toolchain`
* fix(cli/rustup-mode): make `rustup show active-toolchain` exit with `1` when none is active
* fix(cli/rustup-mode): make `rustup default` exit with `1` when there's no default
* fix(cli/rustup-mode)!: change `rustup doc --error_codes` to `--error-codes`
* fix(deps): update rust crate itertools to 0.14
* fix(cli): align `rustup show`'s `--verbose` behavior with `rustup show active-toolchain`
* feat(cli): show the toolchain path with `rustup show active-toolchain --verbose`
* feat(test): accept more than one args in `for_host*!()`
* fix(ci): fix installation of `cargo-all-features`
* docs(user-guide/installation): update 'General tips'
* move deps around
* fix(deps): update rust crate rustls-platform-verifier to 0.5
* fix(rustup-init/sh): don't emit 'unknown macOS major version' for macOS v11+
* refactor(rustup-init/sh): extract `$_os_major`
* refactor(rustup-init/sh): extract `$_os_version`
* ci(linux): move `bindgen-cli` installation into `run.bash`
* ci(stable): enable `loongarch64-unknown-linux-musl` builds
* ci(linux): disable `reqwest-rustls-tls` for unsupported platforms
* ci(linux): configure `gcc-multilib` and `libclang` for some *nix builds
* chore(deps): bump `aws-lc-rs` and `aws-lc-sys`
* download: clean up TLS feature guards
* download: simplify feature guards
* download: attach download functions to Backend type
* download: remove intermediate reqwest-backend feature
* Implement more complete backend selection
* Simplify logic for download backend notification
* docs(dev-guide/tracing): make 'Adding instrumentation' a level-2 title
* ci(windows): don't install `awscli` via `choco`
* test(mock/topical-doc-data): add test cases with both a flag and a topic
* refactor(test/mock): use tuples for `topical_doc_data::TEST_CASES`
* feat(cli/rustup-mode): allow `rustup doc` with both a flag and a topic
* refactor(toolchain): allow passing a fragment in `Toolchain::doc_path()`
* refactor(toolchain): allow absolute paths in `Toolchain::doc_path()`
* refactor(toolchain): simplify `Toolchain::doc_path()`
* refactor(cli/rustup-mode): rename `doc_url` to `doc_path`
* refactor(cli/rustup-mode): make `DocPage::path()` return `Option<&Path>`
* refactor(cli/rustup-mode): move `DocPage::name()` to a separate `impl` block
* refactor(cli/topical-doc): clean up some funtions
* refactor(cli/rustup-mode): use early return in `doc()`
* Update semver-compatible dependencies
* fix: make sure no overflow on small screens
* feat: make the box white
* feat: use the color form the rust website for tags, hr and copy button
* Add the main element and header to setup new layout
* chore: remove the old pitch first
* Apply clippy suggestions
* Append to 1.28.0 changelog
* Bump version, commit and date in rustup-init.sh
* Clean up trailing whitespace in rustup-init.sh
* Add changelog for 1.28.0
* Bump version to 1.28.0
* chore(deps): update remove-dir-all to 1.0
* Add aliases for remove/uninstall/unset commands
* feat: add nushell support
* Upgrade to opentelemetry 0.27
* fix: add missing close body tag
* Upgrade thiserror to 2
* Upgrade to rustls-platform-verifier 0.4
* fix(cli/rustup-mode): remove `.num_args()` when `.value_delimiter(',')` is present
* refactor(cli/rustup-mode): remove deprecated `.use_value_delimiter()`
* chore(config): migrate config .github/renovate.json
* docs: update channel toolchain syntax
* feat(cli/rustup-mode): support more books in `rustup doc`
* style(cli/rustup-mode): reorder items in `docs_data![]`
* fix: add powerpc64 and s390x to known target_arch values for tests
* style(utils): put the `mod` declarations below the imports
* style: regroup some imports
* refactor(utils): hoist `utils::utils` into `utils`
* feat(rustup-init): detect and warn about existing `settings.toml`
* fix: fix typo in `check_existence_of_rustc_or_cargo_in_path()`
* style: allow using `dbg!()` across `rustup::test`
* refactor(diskio): replace `eprintln!()` with `debug!()`
* style: enable `clippy::(dbg_macro|todo)` across the workspace
* style: enable `clippy::print_std(err|out)` when applicable
* style: introduce workspace-wide lint tables
* build: use `workspace.package` properties in `Cargo.toml`
* fix(config): improve error when overridden active custom toolchain isn't installed
* fix(config): print special error for invalid toolchain name in override file
* Update semver-compatible dependencies, except openssl-src
* style(rustup-init/sh): ignore `shellcheck` SC2086 false positives
* fix(rustup-init/sh): fix incorrect TLS warning with curl v8.10
* tests: rust-toolchain + profile in settings
* Remove unnecessary methods
* replace `winreg` dependency
* Update remove_dir_all
* refactor(cli/common)!: deny installing a host-incompatible toolchain w/o `--force-non-host`
* refactor(cli/common)!: take in `toolchain: String` in `warn_if_host_is_incompatible()`
* feat(cli/rustup-mode): add `--force-non-host` to `rustup default`
* refactor(config)!: pass the `force_non_host` flag to `Cfg::ensure_installed()`
* refactor(cli/rustup-mode): rename `forced` to `force_non_host`
* docs(README): Point out where to find nightly/master docs.
* Note that selecting VS lang packs is optional
* Make symlink_or_hardlink_file remove dest
* Try symlinking proxies first
* Apply clippy suggestions from 1.81
* feat(cli/rustup-mode)!: set log level to `INFO`/`DEBUG` on `--quiet`/`--verbose` if `RUSTUP_LOG` is unset
* refactor(cli/setup-mode): extract `update_console_logger()`
* fix(cli/setup-mode): simplify description for `--quiet`
* feat(cli/setup-mode)!: set log level to `DEBUG` on `--verbose` if `RUSTUP_LOG` is unset
* refactor(common)!: remove `verbose` flag in several places
* refactor(config): simplify `find_or_install_active_toolchain()`
* refactor(config)!: return `LocalToolchainName` from `find_or_install_active_toolchain()`
* refactor(config): simplify `resolve_toolchain()`
* refactor(config): simplify `toolchain_from_partial()`
* chore(triage): allow transferring issues to other org repos
* Allow `rustup doc` to search for unions
* docs(user-guide): add a link to the latest 'Previous components' section
* test(cli_v2): introduce `update_removed_component_toolchain()`
* feat(dist): add notes for `stable` and `beta` in `components_missing_msg()`
* refactor(dist): inline some const strings in `components_missing_msg()`
* refactor(dist): extract 'nightly tips' out of the match block in `components_missing_msg()`
* fix: fix typo in several places
* Upgrade pulldown-cmark to 0.12
* fix(manifest): consider possible renames in `Component::try_new()`
* ci(macos): install `awscli` from `brew`
* refactor(config)!: make `toolchain_from_partial()` sync
* feat(config)!: remove implicit installation from `toolchain_from_partial()`
* refactor(config)!: make `resolve_toolchain()` sync
* feat(config)!: remove implicit installation from `resolve_toolchain()`
* test(cli-rustup): remove `heal_damaged_toolchain()`
* refactor(config): extract `local_toolchain()` from `resolve_local_toolchain()`
* refactor(config): extract `toolchain` variable from `resolve_local_toolchain()`
* refactor(config)!: make `resolve_local_toolchain()` sync
* feat(config)!: remove implicit installation from `resolve_local_toolchain()`
* refactor(config)!: rename `local_toolchain()` to `resolve_local_toolchain()`
* feat(rustup-mode): install the active toolchain by default on `rustup toolchain install`
* fix(rustup-mode): adjust descriptions for `rustup toolchain uninstall`
* feat(rustup-mode)!: add `ensure_active_toolchain` flag to `update()`
* feat(config)!: add `verbose` flag to `find_or_install_active_toolchain()`
* style(config): replace `dist::Profile` with `Profile`
* style(config): replace `dist::TargetTriple` with `TargetTriple`
* fix(config): call `warn_if_host_is_incompatible()` in `ensure_installed()`
* refactor(common): use early return in `warn_if_host_is_incompatible()`
* refactor(rustup-mode): extract `warn_if_host_is_incompatible()`
* style(common): merge imports
* refactor(distributable)!: avoid unnecessary clones
* refactor(distributable)!: replace `install_if_not_installed()` with `ensure_installed()`
* feat(config)!: add `verbose` flag to `ensure_installed()`
* feat(config)!: return `UpdateStatus` from `ensure_installed()`
* feat(config)!: use `Cfg::get_profile()` for unspecified profile in `ensure_installed()`
* chore(config): add `#[tracing::instrument]` to `ensure_installed()`
* ci(freebsd): fix build failure related to `aws-lc`
* ci(windows): don't install OpenSSL via `choco`
* ci(run): remove redundant `if` predicate
* ci(run): use the detected number of test threads
* feat(download/rustls): use `aws-lc` instead of `ring`
* style(taplo): enable `reorder_keys` for `*dependencies` in `Cargo.toml`
* Upgrade windows-sys to 0.59
* fix: fix unreachable code lints on Android
* docs(dev-guide): remove descriptions of `rustup_macros`
* docs(dev-guide): update description of `rustup::process`
* Remove `once_cell` dependency
* docs(dev-guide): add guideline for atomic commits to the developer guide
* fix: fix `clippy` lints
* docs(user-guide): use `brew install rustup` instead of `rustup-init`
* Bump fs_at to 0.2.1
* chore(deps/renovate): disable `automerge`
* Upgrade to opentelemetry 0.24
* build(windows): don't link against `powrprof`
* build(windows): fix typo in `build.rs`
* fix(utils): make `ExitCode` `#[must_use]`
* refactor(rustup-mode): introduce `ExitCode::bitand*()`
* fix(rustup-mode): return `ExitCode(1)` when `update()` fails
* refactor(rustup-mode)!: remove redundant `ExitCode` in `self_update()`'s callback
* test(cli-misc): simplify `version_mentions_rustc_version_confusion()`
* fix(rustup-mode): refine output for `rustup --version`
* fix(rustup-mode)!: don't install toolchain on `rustup --version`
* chore(deps/renovate): update `automerge` schedule for `lockFileMaintenance`
* ci(check): add `taplo fmt` test for TOMLs
* style: reformat all TOMLs with `taplo`
* ci(gen-workflows): remove `--quiet` from `git diff`
* refactor: use `#[cfg()]` instead of `cfg!()` when possible
* refactor(self-update): remove outdated `do_pre_install_sanity_checks`
* Add help message for missing toolchain
* Rename OSProcess to OsProcess
* Rename currentprocess to process
* Forward to Process::var_os() directly
* Fix home_dir() and current_dir() regression
* feat(log): set level of `#[tracing::instrument(err)]` to `TRACE`
* feat(log): unhide `tracing::instrument` from behind `feature = 'otel'`
* ci(windows): increase stack size to 16MiB
* Upload Windows artifacts into correct subdirectory
* Fix uploading of Windows build artifacts
* Prepare deployment on master branch
* Grant GitHub Actions workflows access to OIDC token
* chore(deps): update aws-actions/configure-aws-credentials action to v4
* Authenticate CI uploads with OIDC
* Upload release artifacts to new S3 bucket
* chore(deps/renovate): set `prCreation` to `immediate`
* feat(dist): refine suggestions regarding manifest checksum mismatches
* refactor(config): extract `dist_root_server()`
* refactor(dist): use `let-else` in `dl_v2_manifest()`
* refactor(dist/notifications)!: inline usages of `Notification::ManifestChecksumFailedHack`
* refactor(install): avoid extra clone in `InstallMethod::install`
* Reorder operations in order to simplify
* Deduplicate handling of environnment variables
* Move if_not_empty() to calling module
* feat(cli): warn when removing the default/active toolchain
* feat(cli): improve warning when removing the last/host target for a toolchain
* docs(ci): simplify the target policy in the README
* Add loongarch64-unknown-linux-musl support
* fix(download): fix build error with `--no-default-features --features=curl-backend`
* feat(rustup-init): set log level to `WARN` on `-q` if `RUSTUP_LOG` is unset
* implements quiet flag in `rustup-init.sh`
* test(manifestation): introduce and migrate tests to `TestContext`
* chore(manifestation): organize imports
* add regression tests for smart guess
* apply smart guess to `rustup update/uninstall self`
* Disable automatic self updates in CI environments
* feat(download/rustls): use `rustls-platform-verifier`
* ci(windows): run `cargo all-features`
* fix(self-update/windows): address some `unused_imports` warnings
* fix(rustup-mode): improve `clap` error format
* Add period in warning while checking existing rust installations
* Move Windows-only test code into windows module
* Asyncify CLI tests
* Use guard type to replace with_saved_path()
* Refactor test registry state to be more type safe
* Inline single-use with_saved_global_state() function
* Privatize with_saved_global_state()
* Move change_dir() into CliTestContext
* Move with_update_server() into CliTestContext
* Remove Config::with_scenario()
* Port cli_v2 to CliTestContext
* Port cli_v1 to CliTestContext
* Port cli_self_upd to CliTestContext
* Port cli_rustup to CliTestContext
* Port cli_paths to CliTestContext
* Port cli_misc to CliTestContext
* Port cli_inst_interactive to CliTestContext
* Port cli_exact to CliTestContext
* Use CliTestContext directly in self_update_setup()
* Start CliTestContext type wrapper
* docs(dev-guide/tracing): mention `RUSTUP_LOG` and console-based tracing
* docs(dev-guide/linting): improve wording
* test(dist): add simple tests for `PartialVersion`
* chore(dist): add some doc comments
* fix(dist): throw an error when a `PartialVersion` string doesn't start with an ASCII digit
* ci(all-features): add `-D warnings` to `cargo check-all-features`
* fix(currentprocess/filesource): address some `unused_imports` warnings
* fix(currentprocess): address some `unused_imports` warnings
* fix(regex): replace `\d` to `[0-9]` to avoid matching non-ASCII digits
* refactor(toolchain/names): replace `toolchain_sort` with `ToolchainName`'s `Ord` instance
* refactor(dist)!: make `ToolchainDesc.channel` more strongly typed
* Remove unnecessary lint suppressions
* Use local suppression for clippy::too_many_arguments
* Rename desc fields to toolchain
* Remove intermediate state from error handling
* Remove indirection in update error handling
* Inline wrapper function
* Reduce rightward drift
* Propagate use of DistOptions
* Avoid unnecessary unwrapping
* Extract struct from InstallMethods::Dist variant
* refactor(log): replace the `TELEMETRY_DEFAULT_TARCER` singleton with a function
* test(clitools): revive `run_inprocess()`
* fix(dist/arm): don't assume `armv7` if `/proc/cpuinfo` is unavailable
* fix(dist): add fallbacks to `/proc/self/exe` in `rustup-init.sh`
* Rename default-tls to native-tls
* Inline small errors module
* Inline addition/removal to programs
* Move windows-only self_update code into windows module
* Reorganize platform-dependent imports in self_update
* refactor(log): replace `[Ww]arning:` log line prefix with `warn:`
* refactor(log): rename `NotificationLevel::Debug` to `Trace` and `Verbose` to `Debug`
* Remove unused code
* Hoist Toolchain up into top-level toolchain module
* Remove unused derived sorting implementations
* Privatize internal organization of toolchain module
* Inline argument
* Inline trivial wrapper
* Move toolchain resolution into Cfg method
* Check settings version on Cfg construction
* Move proxy toolchain resolution logic into Cfg method
* Move rustc_version() function into Cfg
* Expose higher-level interface in Toolchain
* Move DistributableToolchain::installed_paths() into Cfg
* No need to store cfg in DistributableToolchain
* Reduce indirection in Cfg::from_partial()
* Move Toolchain::from_partial() to Cfg
* Take owned LocalToolchainName in Toolchain::from_local()
* Simplify Toolchain::from_local()
* refactor(dist): hoist `dist::dist` into `dist`
* refactor(dist): privatize imports from `dist::dist`
* Fix the `TODO` in `src\toolchain\toolchain.rs`
* Use tracing macros directly
* Inline single-caller maybe_trace_rustup()
* Remove rustup test wrapper macros
* Use tokio::main attribute
* Attach Process-dependent utils to Process
* Remove with_runtime()
* fix(config): fix typo in `ActiveReason`
* fix(log): use `RUSTUP_LOG` for internal `tracing` instead of `RUST_LOG`
* refactor(currentprocess): make use of `Arc::default()`
* refactor(currentprocess): rename `TestProcess.guard` to `_guard`
* Remove currentprocess::with()
* Privatize most TestProcess fields
* Remove unused TestProcess::id
* Pass Process around explicitly
* Let argument parser handle SelfUpdateMode conversion
* Let argument parser handle Profile conversion
* Use simpler form for string concatenation
* Reduce rightward drift by duplicating some Ok-wrapping
* Rename _install_selection() to IInstallOpts::install()
* Inline async closure
* Move error mapping out of validation function
* Rename do_pre_install_options_sanity_checks() to InstallOpts::validate()
* Rename customize_install() to InstallOpts::customize()
* Pass InstallOpts around directly
* refactor(terminalsource): use `.eq_ignore_ascii_case()` in `ColorableTerminal::new`
* chore(notify): sort logging macros and `NotificationLevel` on verbosity
* chore(env): retire `RUSTUP_DEBUG` in favor of `RUST_LOG`
* feat(log): make `console_logger()` accept `RUSTUP_TERM_COLOR` and `NO_COLOR`
* refactor(log): reimplement `log` using `tracing`
* refactor(test): clean up `before_test_async()`
* chore(deps): make `tracing-subscriber` a hard requirement
* refactor(test): setup `tracing` subscriber in `before_test_async()`
* test(clitools): disable `run_inprocess()`
* refactor(test): execute all `#[rustup_macros::unit_test]`s within a `tokio` context
* refactor(log): extract `telemetry()`
* Remove noop functions in favor of conditional compilation
* Avoid trivial wrapper functions
* Store process name in error variant directly
* Inline trivial wrapper function
* Fix misleading 'uninstalled toolchain' notification
* refactor(ci/run): use more `target_cargo()` in `run.bash`
* Remove trivial new() implementation
* Use serde to encode/decode mock manifests
* Use serde to encode/decode rustup manifests
* Use serde to encode/decode config
* Represent config version as an enum
* ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected rustup package.

Plugin Details

Severity: Critical

ID: 326333

File Name: suse_SU-2026-2831-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 7/10/2026

Updated: 7/10/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.92

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-41898

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-41681

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:rustup, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/9/2026

Vulnerability Publication Date: 12/9/2024

Reference Information

CVE: CVE-2024-12224, CVE-2025-58160, CVE-2026-25727, CVE-2026-41676, CVE-2026-41677, CVE-2026-41678, CVE-2026-41681, CVE-2026-41898, CVE-2026-42327, CVE-2026-44662, CVE-2026-45784

SuSE: SUSE-SU-2026:2831-1

Detections

Analytics

SUSE SLES15 Security Update : rustup (SUSE-SU-2026:2831-1)

critical Nessus Plugin ID 326333

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information