Security advisories for Cargo (CVE-2022-36113, CVE-2022-36114) | Rust Blog

Security advisories for Cargo (CVE-2022-36113, CVE-2022-36114) This is a cross-post of the official security advisory. The official advisory contains a signed version with our PGP key, as well. The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry co

[noritada]

Cargoに脆弱性。.cargo-okというsymlinkで任意のファイルに書き込める問題とzip bomb。9/22リリースのRust 1.64で修正。攻撃方法は限定的なので過去バージョンの修正はしない。と。