CVE-2023-38497

HIGH EPSS 50.8%
Published Aug 4, 20232y ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
High
Find Similar
Published Aug 4, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

CVSS Details

Base Score
7.3
Exploitability
1.3
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
50.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-278
CWE-732

Affected Products 2

VendorProductVersionRange
rust-langcargo* <0.72.2
fedoraprojectfedora38any

References 8

  • en.wikipedia.org https://en.wikipedia.org/wiki/Umask
    Not Applicable
  • github.com https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff
    Patch
  • github.com https://github.com/rust-lang/cargo/pull/12443
    Mailing ListPatch
  • github.com https://github.com/rust-lang/cargo/security/advisories/GHSA-j3xp-wfr4-hx87
    Vendor Advisory
  • github.com https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497
    Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGKE6PGM4HIQUHPJRBQAHMELINSGN4H4/
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMEXGUGPW5OBSQA6URTBNDSU3RAEFOZ4/
  • rust-lang.org https://www.rust-lang.org/policies/security
    Product

Remediation

  • github.com https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff
    Patch
  • github.com https://github.com/rust-lang/cargo/pull/12443
    Mailing ListPatch