Cargo Dependency Mismanagement in Rust Package - CVE-2019-16760
Summary
ALPINE-CVE-2019-16760: Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Affects rust versions < 1.26.0-r0. Fixed in 1.26.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rust is a systems programming language focused on safety and performance. It is widely used for building reliable and efficient software. Cargo is Rust's package manager, responsible for downloading and managing dependencies. The vulnerability in question affects versions of Rust prior to 1.26.0, where Cargo may incorrectly download dependencies due to improper handling of the package configuration key in Cargo.toml files.
Vulnerability Detail
The vulnerability arises from Cargo's failure to recognize the package configuration key in Cargo.toml files in Rust versions 1.25.0 and earlier. This oversight can lead to Cargo downloading incorrect dependencies, which could potentially be malicious packages hosted on crates.io. The issue affects both local manifests and those published to crates.io, posing a significant risk to users relying on these versions. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.26.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rustTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade immediately, a temporary workaround is to avoid using the package key in Cargo.toml files. Instead, ensure that dependencies are specified correctly without renaming them, thus mitigating the risk of downloading incorrect packages.
Conclusion
CVE-2019-16760 presents a significant risk to users of Rust versions prior to 1.26.0 due to Cargo's mishandling of the package key in dependency management. Users are strongly encouraged to update to the latest version to mitigate this vulnerability and ensure the integrity of their software dependencies.
See every vulnerability recorded for rust →
FAQ
CVE-2019-16760 is a vulnerability in Rust's Cargo package manager that can lead to incorrect dependency downloads due to improper handling of the package key in Cargo.toml files.
Rust versions from 1.0.0 to 1.25.0 are affected by this vulnerability. Versions 1.26.0 and later are not affected.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, avoid using the package key in your Cargo.toml files to prevent incorrect dependency downloads.
The CVSS score of CVE-2019-16760 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust.
