Executive brief
Cargo not respecting umask when extracting crate archives
Affected products
- crates.io cargo
Junglewise Threat Intelligence
CVE-2023-38497: Cargo not respecting umask when extracting crate archives
CVE-2023-38497 · Severity: low · CVSS 3.1 · Published 2023-08-03
Technologies: cargo (crates.io). Vendors: crates.io.
Related threats
- Rust Cargo symlink traversal in crate extraction
- Rust Cargo credential leakage via incorrect URL normalization in sparse registries
- Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports
- Cargo did not verify SSH host keys
- Cargo prior to Rust 1.26.0 may download the wrong dependency