Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2019-16760— Cargo prior to Rust 1.26.0 may download the wrong dependency

Quick assessment

Affected
rust cargo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rust是一款通用、编译型编程语言。 Rust 1.26.0之前版本中存在安全漏洞。攻击者可利用该漏洞诱骗用户下载错误的依赖项。

CVSS 4.6 · Medium EPSS 1.26% · P69

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2019-16760

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cargo prior to Rust 1.26.0 may download the wrong dependency
Source: CVE Program / CVE List V5
Vulnerability Description
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
配置
Source: CVE Program / CVE List V5
Vulnerability Title
Rust 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rust是一款通用、编译型编程语言。 Rust 1.26.0之前版本中存在安全漏洞。攻击者可利用该漏洞诱骗用户下载错误的依赖项。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
rust cargo 1.0.0 ~ 1.26.0 -

II. Public POCs for CVE-2019-16760

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2019-16760

请登录查看更多情报信息。

Vendor Advisories for CVE-2019-16760 (1)

Mailing List Discussions for CVE-2019-16760 (1)

Other References for CVE-2019-16760 (2)

IV. Related Vulnerabilities

Same product: cargo
Same vendor: rust
Same weakness: CWE-16

V. Comments for CVE-2019-16760

No comments yet

Leave a comment