-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rust-toolset-1.52 and rust-toolset-1.52-rust security and enhancement update Advisory ID: RHSA-2021:3042-01 Product: Red Hat Developer Tools Advisory URL: https://access.redhat.com/errata/RHSA-2021:3042 Issue date: 2021-08-10 CVE Names: CVE-2020-36323 CVE-2021-28875 CVE-2021-28876 CVE-2021-28877 CVE-2021-28878 CVE-2021-28879 CVE-2021-31162 ===================================================================== 1. Summary: New rust-toolset-1.52 packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 3. Description: Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, the cargo-vendor plugin, and required libraries. The following packages have been upgraded to a later upstream version: rust-toolset-1.52-rust (1.52.1). (BZ#1947197) Security Fix(es): * rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323) * rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context (CVE-2021-28875) * rust: panic safety issue in Zip implementation (CVE-2021-28876) * rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877) * rust: memory safety violation in Zip implementation when next_back() and next() are used together (CVE-2021-28878) * rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879) * rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For information on usage, see Using Rust Toolset linked in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1949194 - CVE-2021-28875 rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context 1949198 - CVE-2021-28876 rust: panic safety issue in Zip implementation 1949204 - CVE-2021-28877 rust: memory safety violation in Zip implementation for nested iter::Zips 1949207 - CVE-2021-28878 rust: memory safety violation in Zip implementation when next_back() and next() are used together 1949211 - CVE-2021-28879 rust: integer overflow in the Zip implementation can lead to a buffer overflow 1950396 - CVE-2020-36323 rust: optimization for joining strings can cause uninitialized bytes to be exposed 1950398 - CVE-2021-31162 rust: double free in Vec::from_iter function if freeing the element panics 6. Package List: Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7): Source: rust-toolset-1.52-1.52.1-1.el7_9.src.rpm rust-toolset-1.52-rust-1.52.1-2.el7_9.src.rpm noarch: rust-toolset-1.52-cargo-doc-1.52.1-2.el7_9.noarch.rpm rust-toolset-1.52-rust-debugger-common-1.52.1-2.el7_9.noarch.rpm rust-toolset-1.52-rust-gdb-1.52.1-2.el7_9.noarch.rpm rust-toolset-1.52-rust-lldb-1.52.1-2.el7_9.noarch.rpm rust-toolset-1.52-rust-src-1.52.1-2.el7_9.noarch.rpm ppc64: rust-toolset-1.52-1.52.1-1.el7_9.ppc64.rpm rust-toolset-1.52-build-1.52.1-1.el7_9.ppc64.rpm rust-toolset-1.52-cargo-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-clippy-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-rls-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-runtime-1.52.1-1.el7_9.ppc64.rpm rust-toolset-1.52-rust-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-rust-analysis-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-rust-debuginfo-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-rust-doc-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-rust-std-static-1.52.1-2.el7_9.ppc64.rpm rust-toolset-1.52-rustfmt-1.52.1-2.el7_9.ppc64.rpm ppc64le: rust-toolset-1.52-1.52.1-1.el7_9.ppc64le.rpm rust-toolset-1.52-build-1.52.1-1.el7_9.ppc64le.rpm rust-toolset-1.52-cargo-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-clippy-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-rls-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-runtime-1.52.1-1.el7_9.ppc64le.rpm rust-toolset-1.52-rust-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-rust-analysis-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-rust-debuginfo-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-rust-doc-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-rust-std-static-1.52.1-2.el7_9.ppc64le.rpm rust-toolset-1.52-rustfmt-1.52.1-2.el7_9.ppc64le.rpm s390x: rust-toolset-1.52-1.52.1-1.el7_9.s390x.rpm rust-toolset-1.52-build-1.52.1-1.el7_9.s390x.rpm rust-toolset-1.52-cargo-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-clippy-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-rls-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-runtime-1.52.1-1.el7_9.s390x.rpm rust-toolset-1.52-rust-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-rust-analysis-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-rust-doc-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-rust-std-static-1.52.1-2.el7_9.s390x.rpm rust-toolset-1.52-rustfmt-1.52.1-2.el7_9.s390x.rpm x86_64: rust-toolset-1.52-1.52.1-1.el7_9.x86_64.rpm rust-toolset-1.52-build-1.52.1-1.el7_9.x86_64.rpm rust-toolset-1.52-cargo-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-clippy-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-rls-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-runtime-1.52.1-1.el7_9.x86_64.rpm rust-toolset-1.52-rust-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-rust-analysis-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-rust-debuginfo-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-rust-doc-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-rust-std-static-1.52.1-2.el7_9.x86_64.rpm rust-toolset-1.52-rustfmt-1.52.1-2.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-36323 https://access.redhat.com/security/cve/CVE-2021-28875 https://access.redhat.com/security/cve/CVE-2021-28876 https://access.redhat.com/security/cve/CVE-2021-28877 https://access.redhat.com/security/cve/CVE-2021-28878 https://access.redhat.com/security/cve/CVE-2021-28879 https://access.redhat.com/security/cve/CVE-2021-31162 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_rust_1.52.1_toolset 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYRIqR9zjgjWX9erEAQgZsQ//R+0ww+vDHnkbouAZshRoLSc1LD24/nbf 80/NxaLswoOWxod76Nrba9bzxvwZyQqeZRgtX6fbqz8SVTI8S5twXjsu5nrmBObs qqEbwbEShY2GkcDxS2u4+R/xxs/ImeuDfY9Y/Cd5Lp66lt5uXuFDL+9gyhomtja+ 8CVnCNiLqHvDiG3Gor+st2dAlVzYRvKavrtGcgiLuNM8LLwVpZ7tiwJ5yiokcYcg X7YeciF0reYBS7NMr+w0Hta2Siw3R8P4U2DSfk0KKO8ibkQVM0m1HJJipehbICLL 8WKmAJTfCO/WFA02hupeGslbky5ptg30AtbXwjovY8B9LwLe0CE4btVfJVHVDXXo zXx4kIoyLmhos4xy26ttcpdlNLobL5U+g+Q7qe9XDoqxk/wg2ilo4cAnes73k1/R vtXIaXuKKZ+Uexr/Ic8NvYbpfFrlg437LkKME/0/r9GXnDCVlHSZ/Q7e2qhzY2Cu NYgE+PIbK8t4pBDT6dsGfO93M/lELGo084HbaOidEMnjkwfIMlyeSrdt1ahTlw+Q NeXYjCrjlfMy511WKiEFwKNykdOtGhOmysV61HFml7qfmcUKp3sDxztMVVQMkpR+ h92etpN/V1oJghpcoYl8pWkIxKXrpC33axKnkdEtEjs63IIzqDkbzj4alOQnVIBn qmXMqpvunOU= =GS8z -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce