[ GLSA 201812-11 ] Rust: Multiple vulnerabilities


This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
–lNLf6mH2LU60PcNnxMtvYKgokPSOIs4us

protected-headers=”v1″
From: Thomas Deutschmann
Reply-To: security@gentoo.org
To: gentoo-announce@lists.gentoo.org
Message-ID:
Subject: [ GLSA 201812-11 ] Rust: Multiple vulnerabilities

–GYXHCZqOTulEirEQvnutbOBVIaWYgjaxj

Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Gentoo Linux Security Advisory GLSA 201812-11
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
https://security.gentoo.org/
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Severity: Normal
Title: Rust: Multiple vulnerabilities
Date: December 30, 2018
Bugs: #662904
ID: 201812-11

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Synopsis

Multiple vulnerabilities have been found in Rust, the worst which may
allow local attackers to execute arbitrary code.

Background

A systems programming language that runs blazingly fast, prevents
segfaults, and guarantees thread safety.

Affected packages

——————————————————————-
Package / Vulnerable / Unaffected
——————————————————————-
1 dev-lang/rust 1.29.1
2 dev-lang/rust-bin 1.29.1
——————————————————————-
2 affected packages

Description

Multiple vulnerabilities have been discovered in Rust. Please review
the CVE identifiers referenced below for details.

Impact

A remote attacker able to control the value passed to Rust’s
str::repeat function could possibly cause a Denial of Service
condition.

In addition, a local attacker could trick another user into executing
arbitrary code when using rustdoc.

Workaround

There is no known workaround at this time.

Resolution

All Rust users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot –verbose “>dev-lang/rust-1.29.1”

All Rust binary users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot –verbose “>dev-lang/rust-bin-1.29.1″

References

[ 1 ] CVE-2018-1000622
https://nvd.nist.gov/vuln/detail/CVE-2018-1000622
[ 2 ] CVE-2018-1000810
https://nvd.nist.gov/vuln/detail/CVE-2018-1000810

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201812-11

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License

Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons – Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

–GYXHCZqOTulEirEQvnutbOBVIaWYgjaxj–

–lNLf6mH2LU60PcNnxMtvYKgokPSOIs4us

Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename=”signature.asc”

—–BEGIN PGP SIGNATURE—–

iQGTBAEBCgB9FiEEExKRzo+LDXJgXHuURObr3Jv2BVkFAlwpNi1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDEz
MTI5MUNFOEY4QjBENzI2MDVDN0I5NDQ0RTZFQkRDOUJGNjA1NTkACgkQRObr3Jv2
BVnz/AgAgqC8YV+4w51/r4iYFEn5NAXhlnWfUFzO3Iv5NeKonZN/Hi8QnEH7jMTT
h40PA2Mxzv4yy1WgUgqAMJaYqrXN+eGCS9QOpUPUC9/iTFE1n5TFMM92rPrOSCjT
uZss9bQYQOyynf1Gr6/tdjfvDRFEwOVYCo3SS6jqBda9ZRVRW8VbqmgSgJhNUEEy
mYU+hZC4qBMGqyqLNr+kS5EBrgHd+ecM0mkQN6e59PBri0Cd2/7F0b9SpMDz5iDV
A9U4Y3gdPQEYJcdU4PsTedDpQQuNJ551Oeyu0OZarTiVADbBnN4hApmRetgUi0HU
EW6P1pLbTK0dGAYoUzSCrusAtfhulw==
=A84/
—–END PGP SIGNATURE—–

–lNLf6mH2LU60PcNnxMtvYKgokPSOIs4us–