Security update for rust1.66 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0132-1 Final 1 1 2023-01-24T14:37:52Z current 2023-01-24T14:37:52Z 2023-01-24T14:37:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rust1.66 This update for rust1.66 fixes the following issues: - CVE-2022-46176: Fixed missing SSH host key verification in cargo when cloning indexes and dependencies via SSH(bsc#1206930). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/rust:1.66-2023-132,SUSE-2023-132,SUSE-SLE-Module-Development-Tools-15-SP4-2023-132,openSUSE-SLE-15.4-2023-132 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230132-1/ Link for SUSE-SU-2023:0132-1 https://lists.suse.com/pipermail/sle-security-updates/2023-January/013516.html E-Mail link for SUSE-SU-2023:0132-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1206930 SUSE Bug 1206930 https://www.suse.com/security/cve/CVE-2022-46176/ SUSE CVE CVE-2022-46176 page Container bci/rust:1.66 SUSE Linux Enterprise Module for Development Tools 15 SP4 openSUSE Leap 15.4 cargo1.66-1.66.0-150400.9.9.1 rust1.66-1.66.0-150400.9.9.1 cargo1.66-1.66.0-150400.9.9.1 as a component of Container bci/rust:1.66 rust1.66-1.66.0-150400.9.9.1 as a component of Container bci/rust:1.66 cargo1.66-1.66.0-150400.9.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 rust1.66-1.66.0-150400.9.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 cargo1.66-1.66.0-150400.9.9.1 as a component of openSUSE Leap 15.4 rust1.66-1.66.0-150400.9.9.1 as a component of openSUSE Leap 15.4 Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible. CVE-2022-46176 Container bci/rust:1.66:cargo1.66-1.66.0-150400.9.9.1 Container bci/rust:1.66:rust1.66-1.66.0-150400.9.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:cargo1.66-1.66.0-150400.9.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:rust1.66-1.66.0-150400.9.9.1 openSUSE Leap 15.4:cargo1.66-1.66.0-150400.9.9.1 openSUSE Leap 15.4:rust1.66-1.66.0-150400.9.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230132-1/ https://www.suse.com/security/cve/CVE-2022-46176.html CVE-2022-46176 https://bugzilla.suse.com/1206930 SUSE Bug 1206930