Executive brief
Cargo did not verify SSH host keys
Affected products
- crates.io cargo
Junglewise Threat Intelligence
CVE-2022-46176: Cargo did not verify SSH host keys
CVE-2022-46176 · Severity: low · CVSS 3.1 · Published 2023-01-10
Technologies: cargo (crates.io). Vendors: crates.io.
Related threats
- Rust Cargo symlink traversal in crate extraction
- Rust Cargo credential leakage via incorrect URL normalization in sparse registries
- Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports
- Cargo not respecting umask when extracting crate archives
- Cargo prior to Rust 1.26.0 may download the wrong dependency