This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-1000622 →

DEBIAN-CVE-2018-1000622

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plu...

Original description

The description as published by the source.

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rustc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1+dfsg1-1~exp1"}]}]

Debian:13 rustc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1+dfsg1-1~exp1"}]}]

Debian:14 rustc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1+dfsg1-1~exp1"}]}]

References

advisory security-tracker.debian.org