{"id":"CVE-2018-1000622","aliases":["BELL-CVE-2018-1000622","DEBIAN-CVE-2018-1000622","EUVD-2018-1957","GHSA-6f94-33qx-gqcf","MGASA-2018-0318","RHEA-2018:3584","SUSE-RU-2019:0386-1","SUSE-SU-2018:3357-1","SUSE-SU-2019:2439-1","SUSE-SU-2019:2755-1","openSUSE-SU-2019:2203-1","openSUSE-SU-2019:2244-1","openSUSE-SU-2019:2294-1","openSUSE-SU-2024:11359-1","openSUSE-SU-2024:11360-1"],"status":"published","title":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427:...","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01819,"percentile":0.78907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2018-07-09T20:00:00Z","modified":"2026-10-24T10:30:45Z","fixes":[{"ecosystem":"Debian:12","package":"rustc","fixed_in":["1.27.1+dfsg1-1~exp1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rustc","fixed_in":["1.27.1+dfsg1-1~exp1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rustc","fixed_in":["1.27.1+dfsg1-1~exp1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"rust","fixed_in":["1.27.1-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-build","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo","fixed_in":["0:1.29.0-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo-doc","fixed_in":["0:1.29.0-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo-vendor","fixed_in":["0:0.1.17-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo-vendor-debuginfo","fixed_in":["0:0.1.17-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-clippy-preview","fixed_in":["0:0.0.212-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rls-preview","fixed_in":["0:0.130.0-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-runtime","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-analysis","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-debugger-common","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-debuginfo","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-doc","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-gdb","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-lldb","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-src","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-std-static","fixed_in":["0:1.29.2-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rustfmt-preview","fixed_in":["0:0.99.1-1.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"rust","fixed_in":["1.31.1-3.9.2","1.24.1-3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1+dfsg1-1~exp1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1+dfsg1-1~exp1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1+dfsg1-1~exp1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo-vendor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.17-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-cargo-vendor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.17-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-clippy-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.212-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rls-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.130.0-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-analysis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.2-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2018","package":"rust-toolset-1.29-rustfmt-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.1-1.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.1-3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.1-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-lp151.5.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust-cbindgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-lp151.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-lp151.5.4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-lp151.5.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rust-cbindgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-lp151.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-2.5"}]}],"bundled":3}],"products":[{"vendor":"rust-lang","product":"rust"}],"references":[{"url":"https://security.gentoo.org/glsa/201812-11","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://groups.google.com/forum/#%21topic/rustlang-security-announcements/4ybxYLTtXuM","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000622","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/rustlang-security-announcements/4ybxYLTtXuM","tags":["article"]},{"url":"https://github.com/advisories/GHSA-6f94-33qx-gqcf"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-1000622","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000622","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0318.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23328","tags":["report"]},{"url":"https://blog.rust-lang.org/2018/07/06/security-advisory-for-rustdoc.html","tags":["advisory"]},{"url":"https://blog.rust-lang.org/2018/07/10/Rust-1.27.1.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHEA-2018:3584","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/2018.4/html/using_rust_toolset/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1562177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1562186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1562189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1562192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1562196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1591301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1599904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611006","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611608","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhea-2018_3584.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1597063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000622","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2019-386/suse-ru-20190386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1100691","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000622","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183357-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192439-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096945","tags":["report"]},{"url":"https://bugzilla.suse.com/1133283","tags":["report"]},{"url":"https://bugzilla.suse.com/1134978","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192755-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZOZ25VGM7BURWQNSR2QRJK6ZK2KHN2N/#MZOZ25VGM7BURWQNSR2QRJK6ZK2KHN2N","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VSDFMUYOGHL27XJBTF3UGFLJVXGMLKDW/#VSDFMUYOGHL27XJBTF3UGFLJVXGMLKDW","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/THHMWZRJWFDVITSZZRA3U6YLX2IZ53LA/#THHMWZRJWFDVITSZZRA3U6YLX2IZ53LA","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1967","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000622","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","status":"published","published":"2018-07-09T20:00:00Z","modified":"2024-08-05T12:40:47.595Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1957","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","status":"published","published":"2018-07-09T20:00:00Z","modified":"2024-08-05T12:40:47Z","updated_at":"2026-11-03T02:39:26.268404Z"}],"ghsa":[{"id":"GHSA-6f94-33qx-gqcf","title":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427:...","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","status":"published","published":"2022-05-13T01:54:06Z","modified":"2023-02-02T05:02:22Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:51:25.546182Z"}],"nvd":[{"id":"CVE-2018-1000622","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","status":"published","published":"2018-07-09T20:29:00.817Z","modified":"2026-06-17T01:32:57.593Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"BELL-CVE-2018-1000622","title":"CVE-2018-1000622 does not affect BellSoft software","status":"withdrawn","published":"2018-07-09T20:29:00Z","modified":"2026-01-26T09:46:00.840607Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-1000622","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","status":"published","published":"2018-07-09T20:29:00.817Z","modified":"2026-10-24T10:30:45.286944957Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000622","description":"The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.","status":"published","published":"2018-07-09T20:29:00.817Z","modified":"2026-10-23T18:04:46.408362204Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHEA-2018:3584","title":"Red Hat Enhancement Advisory: new packages: rust-toolset-1.29","status":"published","published":"2024-09-14T00:39:28Z","modified":"2026-06-26T10:36:12Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"MGASA-2018-0318","title":"Updated rust packages fix security vulnerability","description":"\n The Rust Programming Language rustdoc version before version 1.27.0 contains\n a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins\n that can result in local code execution as a different user. This attack\n appear to be exploitable via using the --plugin flag without the --plugin-path \n flag. This vulnerability has been fixed in 1.27.1 (CVE-2018-1000622).\n\n This update also fixes a bug in the borrow checker verification of match\n expressions.\n","status":"published","published":"2018-07-23T22:27:34Z","modified":"2026-04-16T06:23:25.447470593Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2203-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\nThis update was imported from SUSE:SLE-15:Update.\n","status":"published","published":"2019-09-27T07:40:16Z","modified":"2026-02-04T02:47:26.846498Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2244-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-03T09:22:00Z","modified":"2026-02-04T02:42:56.822624Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2294-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-08T12:19:04Z","modified":"2026-02-04T03:25:11.006803Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11359-1","title":"cargo-1.54.0-1.2 on GA media","description":"These are all security issues fixed in the cargo-1.54.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:27.843903Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11360-1","title":"cargo1.53-1.53.0-2.5 on GA media","description":"These are all security issues fixed in the cargo1.53-1.53.0-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:23.126356Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-RU-2019:0386-1","title":"Security update for rust","description":"\n\nRust was updated to version 1.31.1.\n  ","status":"published","published":"2019-02-14T10:24:20Z","modified":"2026-02-04T03:58:39.834194Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2018:3357-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution\n  This patch consists of requiring `--plugin-path` to be passed whenever `--plugin` is passed\n  Note that rustdoc plugins will be removed entirely on 1.28.0 (bsc#1100691).\n","status":"published","published":"2018-10-23T14:43:38Z","modified":"2026-02-04T04:20:26.982392Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:2439-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n","status":"published","published":"2019-09-23T15:14:47Z","modified":"2026-02-04T02:29:04.846849Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2755-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\nRust was updated to version 1.36.0.\n\nSecurity issues fixed:\n\n- CVE-2019-12083: a standard method can be overridden violating Rust's safety guarantees and causing memory unsafety (bsc#1134978)\n- CVE-2018-1000622: rustdoc loads plugins from world writable directory allowing for arbitrary code execution (bsc#1100691)\n\n","status":"published","published":"2019-10-23T13:24:35Z","modified":"2026-02-04T03:09:04.017636Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}