Read the docs
TI-2023-19877 Aliases CVE-2023-38497GHSA-j3xp-wfr4-hx87

Cargo not respecting umask when extracting crate archives

Priority LOW 37CWE-278Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Fix Fixed cargo (rust-lang): 0.72.2cargo (crates.io): 0.72.2Red Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rust-langcargobefore 0.72.20.72.2Patch availableCNA
—cargo (crates.io)before 0.72.20.72.2Patch availableGHSA-j3xp-wfr4-hx87
  • cargo Vendorrust-lang Affected before 0.72.2 Fixed in 0.72.2 Patch available CNA
  • cargo (crates.io) Vendor— Affected before 0.72.2 Fixed in 0.72.2 Patch available GHSA-j3xp-wfr4-hx87

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*before 0.72.2Vulnerablerust-lang
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
  • cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:* Versions before 0.72.2 Vulnerable ·rust-lang
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA cargo (rust-lang) Fixed in 0.72.2
  • Fix · GHSA-j3xp-wfr4-hx87 cargo (crates.io) Fixed in 0.72.2 Advisory →

Red Hat 5 advisories

  • RHSA-2024:3418 Released 2024-05-28 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) cargo-1.58.1-1.el9_0.1, cargo-doc-1.58.1-1.el9_0.1, clippy-1.58.1-1.el9_0.1 +12
  • RHSA-2024:3428 Released 2024-05-28 · Red Hat rating Important
    rust-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) cargo-1.58.1-1.module+el8.6.0+21522+a4bc17c1.1.aarch64::rust-toolset:rhel8, cargo-1.58.1-1.module+el8.6.0+21522+a4bc17c1.1.ppc64le::rust-toolset:rhel8, cargo-1.58.1-1.module+el8.6.0+21522+a4bc17c1.1.s390x::rust-toolset:rhel8 +46
  • RHSA-2023:4651 Released 2023-08-15 · Red Hat rating Important
    rust-toolset-1.66-rust security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rust-toolset-1.66-cargo-1.66.1-2.el7_9, rust-toolset-1.66-clippy-1.66.1-2.el7_9, rust-toolset-1.66-rust-1.66.1-2.el7_9 +9
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rust-toolset-1.66-cargo-1.66.1-2.el7_9, rust-toolset-1.66-clippy-1.66.1-2.el7_9, rust-toolset-1.66-rust-1.66.1-2.el7_9 +9
Show 2 more Red Hat advisories
  • RHSA-2023:4635 Released 2023-08-14 · Red Hat rating Important
    rust-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.aarch64::rust-toolset:rhel8, cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.ppc64le::rust-toolset:rhel8, cargo-1.66.1-2.module+el8.8.0+19613+f0bba33b.s390x::rust-toolset:rhel8 +44
  • RHSA-2023:4634 Released 2023-08-14 · Red Hat rating Important
    rust security update
    • Red Hat Enterprise Linux AppStream (v. 9) cargo-1.66.1-2.el9_2, clippy-1.66.1-2.el9_2, rust-1.66.1-2.el9_2 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2023:4651
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2023:4651
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:4635
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:4634
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:3428
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:3418

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38497
  2. 2026-10-03 Alias added: GHSA-j3xp-wfr4-hx87

References

Patch 2

Advisory 4

Other 6

  • TI-2022-16536 Extracting malicious crates can corrupt arbitrary files CVSS 3.1HIGH 8.1
  • TI-2022-16537 Extracting malicious crates can fill the file system CVSS 3.1MEDIUM 6.5
  • TI-2026-04563 Crates in third party registries can override the cached source of other crates CVSS 4.0MEDIUM 6.5
  • TI-2022-22820 Cargo did not verify SSH host keys CVSS 3.1MEDIUM 5.9
  • TI-2026-04562 Cargo can be coerced to share credentials between registries CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences