1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202210-09 ] Rust: Multiple Vulnerabilities

    From glsamaker@gentoo.org@21:1/5 to All on Sun Oct 16 17:00:01 2022
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202210-09
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: Normal
    Title: Rust: Multiple Vulnerabilities
    Date: October 16, 2022
    Bugs: #870166, #831638, #821157, #807052, #782367
    ID: 202210-09

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulnerabilities have been discovered in Rust, the worst of
    which could result in denial of service.

    Background
    ==========

    A systems programming language that runs blazingly fast, prevents
    segfaults, and guarantees thread safety.

    Affected packages
    =================

    -------------------------------------------------------------------
    Package / Vulnerable / Unaffected
    -------------------------------------------------------------------
    1 dev-lang/rust < 1.63.0-r1 >= 1.63.0-r1
    2 dev-lang/rust-bin < 1.64.0 >= 1.64.0

    Description
    ===========

    Multiple vulnerabilities have been discovered in Rust. Please review the
    CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All Rust users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/rust-1.63.0-r1"

    All Rust binary users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/rust-bin-1.64.0"

    In addition, users using Portage 3.0.38 or later should ensure that
    packages with Rust binaries have no vulnerable code statically linked
    into their binaries by rebuilding the @rust-rebuild set:

    # emerge --ask --oneshot --verbose @rust-rebuild

    References
    ==========

    [ 1 ] CVE-2021-28875
    https://nvd.nist.gov/vuln/detail/CVE-2021-28875
    [ 2 ] CVE-2021-28876
    https://nvd.nist.gov/vuln/detail/CVE-2021-28876
    [ 3 ] CVE-2021-28877
    https://nvd.nist.gov/vuln/detail/CVE-2021-28877
    [ 4 ] CVE-2021-28878
    https://nvd.nist.gov/vuln/detail/CVE-2021-28878
    [ 5 ] CVE-2021-28879
    https://nvd.nist.gov/vuln/detail/CVE-2021-28879
    [ 6 ] CVE-2021-29922
    https://nvd.nist.gov/vuln/detail/CVE-2021-29922
    [ 7 ] CVE-2021-31162
    https://nvd.nist.gov/vuln/detail/CVE-2021-31162
    [ 8 ] CVE-2021-36317
    https://nvd.nist.gov/vuln/detail/CVE-2021-36317
    [ 9 ] CVE-2021-36318
    https://nvd.nist.gov/vuln/detail/CVE-2021-36318
    [ 10 ] CVE-2021-42574
    https://nvd.nist.gov/vuln/detail/CVE-2021-42574
    [ 11 ] CVE-2021-42694
    https://nvd.nist.gov/vuln/detail/CVE-2021-42694
    [ 12 ] CVE-2022-21658
    https://nvd.nist.gov/vuln/detail/CVE-2022-21658
    [ 13 ] CVE-2022-36113
    https://nvd.nist.gov/vuln/detail/CVE-2022-36113
    [ 14 ] CVE-2022-36114
    https://nvd.nist.gov/vuln/detail/CVE-2022-36114

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202210-09

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2022 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmNMGIMACgkQFMQkOaVy +9nSchAAqGBbYQ8QvRgsGc3JsxYxyUkll04vqRuX6A04H1b0TJU7d/mdM5tq/BKE 2C+bJ7SCwOQKIMq1PaVBr9c7IteVAGwm4bjFutBv97lQrKO/MjaZjpto4b5lOH59 8p3rOGUM/btiWgbyHccMcZ2bueNsAoPPuL3ibHp6wlSgMgb/8V3lBFSBE7CKcJtb vitA7EOrfocOCDhSHDc5+8pFv8vovc/dgmN3OmUT9lQeuhh0cjBNNlubi5t7q9Sh XqCUObkpL5gJ6huT/vNZKHnDRnenqBbR7qHLbJLuRIqvwlhSfrDG2vFhl2tVBHGz iTadR4Jrssl3PaY/cl3uqbCEMAzPq5LQwLRXjKXABxZJUVNGcSzfi6q4Csi26Co1 ElMUq+As13p30eUjokgu+sIfD3CaKigSAB9kfL0uOCxqP3ri65qL+WccVOOnhBOS ibJnEVttCwSvrquQxmFV9LDzfaGHCsH7DhAgy3qAqiEw4fSI6/kl5C5k1wsAHzsr cRJIdSWgOVK+AZGGzpMXnGRpiI+HEBtppfkuZuL0LOWobL9PVEcrVd4lyz543MNB TO/SK7ccaA5sAd0iuxBLBPNORh1O68JRzcDe2RBw1eQy4M4UVFZWnOfi9CcZ/Al4 zLYjHAiU3qAGTN3XZesVEyKWRive3Mqx0Tqg9gP3wFUiN2sXWuA=
    =t5OT
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)