2 lines
4.4 KiB
JSON
2 lines
4.4 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://crates.io","defaultStatus":"unaffected","packageName":"cargo","product":"Cargo","repo":"https://github.com/rust-lang/cargo","vendor":"Rust Project","versions":[{"lessThan":"1.96.0","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"986d4109-89ea-491f-99fd-a8e4803919bd"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rust-lang:cargo:*:*:*:*:*:rust:*:*","matchCriteriaId":"67F6F381-6055-48F2-A156-047F903ABE84","versionEndExcluding":"1.96.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink."},{"lang":"es","value":"Cargo gestionó incorrectamente los enlaces simbólicos dentro de los tarballs de crates descargados de registros de terceros, permitiendo que un crate malicioso sobrescribiera el código fuente de otro crate del mismo registro. La gravedad de la vulnerabilidad es media para los usuarios de registros de terceros. Los usuarios de crates.io no se ven afectados, ya que crates.io prohíbe subir crates que contengan enlaces simbólicos."}],"id":"CVE-2026-5223","lastModified":"2026-07-23T17:10:00.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"986d4109-89ea-491f-99fd-a8e4803919bd","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5223","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-26T14:36:37.949868Z","version":"2.0.3"}}]},"published":"2026-05-25T10:16:15.480","references":[{"source":"986d4109-89ea-491f-99fd-a8e4803919bd","tags":["Mitigation","Vendor Advisory"],"url":"https://blog.rust-lang.org/2026/05/25/cve-2026-5223/"},{"source":"986d4109-89ea-491f-99fd-a8e4803919bd","tags":["Issue Tracking","Patch"],"url":"https://github.com/rust-lang/cargo/pull/17031"},{"source":"986d4109-89ea-491f-99fd-a8e4803919bd","tags":["Mailing List","Third Party Advisory"],"url":"https://groups.google.com/g/rustlang-security-announcements/c/IB74S7Yksg8"}],"sourceIdentifier":"986d4109-89ea-491f-99fd-a8e4803919bd","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"986d4109-89ea-491f-99fd-a8e4803919bd","type":"Secondary"}]}
|