FEDORA-2021-d7f74f0250 — security update for rust

stable

rust-1.51.0-3.fc32

FEDORA-2021-d7f74f0250 created by jistone 3 years ago for Fedora 32

Security fixes for CVE-2020-36323, CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162.

These are memory safety bugs in the Rust standard library. Because it is statically linked, affected applications will need to be rebuilt to benefit from the fixes. The actual security implications will depend on how these APIs are used in each particular case.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2021-d7f74f0250

This update has been submitted for testing by jistone.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update's test gating status has been changed to 'waiting'.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update has been pushed to testing.

3 years ago

This update can be pushed to stable now if the maintainer wishes

3 years ago

This update has been submitted for stable by bodhi.

3 years ago

This update has been pushed to stable.

3 years ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

3 years ago

in testing

3 years ago

in stable

3 years ago

Builds

rust-1.51.0-3.fc32

BZ#1949198 CVE-2021-28876 rust: panic safety issue in Zip implementation

BZ#1949199 CVE-2021-28876 rust: panic safety issue in Zip implementation [fedora-all]

BZ#1949207 CVE-2021-28878 rust: memory safety violation in Zip implementation when next_back() and next() are used together

BZ#1949208 CVE-2021-28878 rust: memory safety violation in Zip implementation when next_back() and next() are used together [fedora-all]

BZ#1949211 CVE-2021-28879 rust: integer overflow in the Zip implementation can lead to a buffer overflow

BZ#1949212 CVE-2021-28879 rust: integer overflow in the Zip implementation can lead to a buffer overflow [fedora-all]

BZ#1950396 CVE-2020-36323 rust: optimization for joining strings can cause uninitialized bytes to be exposed

BZ#1950398 CVE-2021-31162 rust: double free in Vec::from_iter function if freeing the element panics

BZ#1950400 CVE-2021-31162 rust: double free in Vec::from_iter function if freeing the element panics [fedora-all]

BZ#1950485 CVE-2020-36323 rust: optimization for joining strings can cause uninitialized bytes to be exposed [fedora-all]

rust-1.51.0-3.fc32

Automated Test Results

ignored

Test Cases


0	0	Test Case rust compile