-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update Advisory ID: RHSA-2021:3063-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:3063 Issue date: 2021-08-10 CVE Names: CVE-2020-36323 CVE-2021-28875 CVE-2021-28876 CVE-2021-28877 CVE-2021-28878 CVE-2021-28879 CVE-2021-31162 ===================================================================== 1. Summary: An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. The following packages have been upgraded to a later upstream version: rust (1.52.1). (BZ#1953002) Security Fix(es): * rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323) * rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context (CVE-2021-28875) * rust: panic safety issue in Zip implementation (CVE-2021-28876) * rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877) * rust: memory safety violation in Zip implementation when next_back() and next() are used together (CVE-2021-28878) * rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879) * rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For information on usage, see Using Rust Toolset linked in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1949194 - CVE-2021-28875 rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context 1949198 - CVE-2021-28876 rust: panic safety issue in Zip implementation 1949204 - CVE-2021-28877 rust: memory safety violation in Zip implementation for nested iter::Zips 1949207 - CVE-2021-28878 rust: memory safety violation in Zip implementation when next_back() and next() are used together 1949211 - CVE-2021-28879 rust: integer overflow in the Zip implementation can lead to a buffer overflow 1950396 - CVE-2020-36323 rust: optimization for joining strings can cause uninitialized bytes to be exposed 1950398 - CVE-2021-31162 rust: double free in Vec::from_iter function if freeing the element panics 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: rust-1.52.1-1.module+el8.4.0+11282+0729bac9.src.rpm rust-toolset-1.52.1-1.module+el8.4.0+11282+0729bac9.src.rpm aarch64: cargo-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm cargo-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm clippy-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm clippy-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rls-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rls-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-analysis-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-debugsource-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-doc-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-std-static-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rust-toolset-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rustfmt-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm rustfmt-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.aarch64.rpm noarch: cargo-doc-1.52.1-1.module+el8.4.0+11282+0729bac9.noarch.rpm rust-debugger-common-1.52.1-1.module+el8.4.0+11282+0729bac9.noarch.rpm rust-gdb-1.52.1-1.module+el8.4.0+11282+0729bac9.noarch.rpm rust-lldb-1.52.1-1.module+el8.4.0+11282+0729bac9.noarch.rpm rust-src-1.52.1-1.module+el8.4.0+11282+0729bac9.noarch.rpm ppc64le: cargo-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm cargo-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm clippy-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm clippy-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rls-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rls-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-analysis-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-debugsource-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-doc-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-std-static-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rust-toolset-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rustfmt-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm rustfmt-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.ppc64le.rpm s390x: cargo-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm cargo-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm clippy-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm clippy-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rls-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rls-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-analysis-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-debugsource-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-doc-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-std-static-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rust-toolset-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rustfmt-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm rustfmt-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.s390x.rpm x86_64: cargo-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm cargo-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm clippy-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm clippy-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rls-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rls-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-analysis-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-debugsource-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-doc-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-std-static-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rust-toolset-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rustfmt-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm rustfmt-debuginfo-1.52.1-1.module+el8.4.0+11282+0729bac9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-36323 https://access.redhat.com/security/cve/CVE-2021-28875 https://access.redhat.com/security/cve/CVE-2021-28876 https://access.redhat.com/security/cve/CVE-2021-28877 https://access.redhat.com/security/cve/CVE-2021-28878 https://access.redhat.com/security/cve/CVE-2021-28879 https://access.redhat.com/security/cve/CVE-2021-31162 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_rust_1.52.1_toolset 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYRKHHdzjgjWX9erEAQje9A/+PfhiLHWNvykQQ6juouVudUNGIspaq/yW botQHJtEHsdXaFzfqCI/oALfB9S3TR0cGgocMS08P9BtYlcq5G3WMGiZyXhtYAxb fWj2SwQy6nflTOb2AI7FrCKMKL3FEVvkxmWnVaFBiAGdGKPOA3qgLZnKlcFUa4Fp owzLRTU8Bbfw1DaMDIEZeLieRwnHeXZgI3SCaPKR1c7LYlFNKzPAXiNqOd+SxGjo G/r0YvmlF2g0uGmfkQ3/AFDc3P/gllshvI3iD+9gaaAjlA0w4Iiz2KIrNdE5BMiz WXT1EPylvvNvTkuS0DGWmL3qu1CCSTBUILPLBC+iARNx8bitt4qgqNIUbjYAPeJd QTHbOinOxZR4BM5t8GY2Bj0APBN3sAaiwX7+rHg0f2WROyGUh5ByCagCwcIz9iVb yWnJsnl4PwVfQjwwpRmukpZuBBFz5TDvFKJScfIz88CKCOfeC5GSIr67dk0YFXc9 YGzyWcZ7H2snPi9CIAduX0KIf1oKccycD5S22IBPmqIJMruSslT9LF1lANTHznYM FkdjGc7OQ7xzfRK+SeT/hPoGGV7wJ3f8Bu09s0sWuAjk7if8Ei4g4xW8FhU85oyr PpocLDXHFv+Q+UBFQkq2U8L5aKVKLbRwzQfRaSE9LNW4VXjRlQE80y659G0XPl4k ivLdhk2eaCg= =GDu7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce