Executive brief
Cargo prior to Rust 1.26.0 may download the wrong dependency
Affected products
- crates.io cargo
Junglewise Threat Intelligence
CVE-2019-16760: Cargo prior to Rust 1.26.0 may download the wrong dependency
CVE-2019-16760 · Severity: low · CVSS 3.1 · Published 2022-05-24
Technologies: cargo (crates.io). Vendors: crates.io.
Related threats
- Rust Cargo symlink traversal in crate extraction
- Rust Cargo credential leakage via incorrect URL normalization in sparse registries
- Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports
- Cargo not respecting umask when extracting crate archives
- Cargo did not verify SSH host keys