CVE-2022-46176
Summary
| CVE | CVE-2022-46176 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-01-11 21:15:00 UTC |
| Updated | 2023-11-07 03:55:00 UTC |
| Description | Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible. |
Risk And Classification
Problem Types: CWE-347
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - Re: CVE-2022-46176: Cargo does not check SSH host keys | www.openwall.com | ||
| oss-security - Re: CVE-2022-46176: Cargo does not check SSH host keys | MISC | www.openwall.com | |
| Cargo did not verify SSH host keys · Advisory · rust-lang/cargo · GitHub | MISC | github.com | |
| wg-security-response/patches/CVE-2022-46176 at main · rust-lang/wg-security-response · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 182335 Debian Security Update for cargorust-cargo (CVE-2022-46176)
- 283602 Fedora Security Update for rust (FEDORA-2023-19bcafe341)
- 283620 Fedora Security Update for rust (FEDORA-2023-575fcaf4bf)
- 354709 Amazon Linux Security Advisory for rust : ALAS2022-2023-278
- 355226 Amazon Linux Security Advisory for rust : ALAS2023-2023-109
- 503264 Alpine Linux Security Update for rust
- 505932 Alpine Linux Security Update for rust
- 753555 SUSE Enterprise Linux Security Update for rust1.65 (SUSE-SU-2023:0133-1)
- 753557 SUSE Enterprise Linux Security Update for rust1.66 (SUSE-SU-2023:0132-1)
- 905198 Common Base Linux Mariner (CBL-Mariner) Security Update for rust (12967)
- 905233 Common Base Linux Mariner (CBL-Mariner) Security Update for rust (12969)
- 906755 Common Base Linux Mariner (CBL-Mariner) Security Update for rust (12969-1)