Cargo Package Renaming Vulnerability in Rust
Summary
CVE-2019-16760: Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Affects rust across 2 version ranges.
< 1.26.0-r0
< a7756804103447ea4e68a71ccf071e7ad8f7a03e
Fixed in 1.26.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rust is a programming language that focuses on safety, speed, and concurrency. It is widely used for developing system software, embedded systems, and web applications. Cargo is the package manager and build system for Rust. It manages dependencies and compiles Rust projects. However, prior to Rust 1.26.0, Cargo had a vulnerability related to package renaming in the package.toml file.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16760, arises when using the package configuration key in the package.toml file. In Rust versions 1.25.0 and earlier, the package key is ignored, causing Cargo to download the wrong dependency. This issue affects both locally written manifests and manifests published to crates.io. An attacker could exploit this vulnerability by squatting on crates.io and providing a malicious package, which could lead to various security risks. Rust versions 1.0.0 through 1.25.0 are affected, while versions 1.26.0 and newer are not. Users are strongly advised to update their compiler to the latest available version to prevent this issue.
How To Fix
Minimum fixed version
1.26.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rustTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Cargo package renaming vulnerability in Rust (CVE-2019-16760) can lead to the download of incorrect dependencies, potentially exposing projects to malicious packages. Users are strongly advised to update their Rust compiler to version 1.26.0 or newer to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rust →
FAQ
Rust is a programming language known for its focus on safety, speed, and concurrency. It is widely used for developing system software, embedded systems, and web applications.
Cargo is the package manager and build system for Rust. It manages dependencies and compiles Rust projects.
The package key in the package.toml file is used to rename dependencies in Cargo. However, prior to Rust 1.26.0, this key was ignored, leading to the vulnerability described in CVE-2019-16760.
An attacker can exploit this vulnerability by squatting on crates.io and providing a malicious package. When Cargo ignores the package key, it may download the wrong dependency, which could be the attacker's malicious package.
To protect your Rust project, it is crucial to update your compiler to Rust 1.26.0 or newer. Additionally, ensure that the package key is used correctly in the package.toml file.
Related vulnerabilities
Recent vulnerabilities recorded for rust.
