** Description changed: - A full description of this CVE can be found on the rust-lang blog[1]. + [ Impact ] - Cargo incorrectly normalizes the URLs of third-party registries using - the sparse index protocol, allowing for credential stealing in very - specific circumstances. + * A full description of this bug can be found on the rust-lang blog[1]. - The severity of this vulnerability is very low due to the extremely - niche requirements needed to achieve the attack. + * Cargo incorrectly normalizes the URLs of third-party registries using the + sparse index protocol, allowing for credential stealing in very specific + circumstances. + + * The severity of this vulnerability is very low due to the niche requirements + needed to achieve the attack. [1]: https://blog.rust-lang.org/2026/05/25/cve-2026-5222/ + + [ Test Plan ] + + * The patch cherry-picked from upstream provides a new unit test, + test_canonicalize_idents_does_not_strip_dot_git_for_sparse, to + sources/git/source.rs. The fix can be verified by ensuring that test passes + in the build log. + + * However, the fix can also be manually verified by checking to see if cargo + recognizes that two URLs which only differ by ".git" are properly treated as + two different registries: + + # apt update && apt install -y cargo-1.80 + [...] + + BEFORE: + + $ env CARGO_HOME="$(mktemp -d)" \ + CARGO_REGISTRIES_A_INDEX='sparse+http://127.0.0.1:1/index/' \ + CARGO_REGISTRIES_B_INDEX='sparse+http://127.0.0.1:1/index.git' \ + cargo-1.80 logout --registry a + error: multiple registries are configured with the same index url 'sparse+http://127.0.0.1:1/index/': a, b + + AFTER: + + $ env CARGO_HOME="$(mktemp -d)" \ + CARGO_REGISTRIES_A_INDEX='sparse+http://127.0.0.1:1/index/' \ + CARGO_REGISTRIES_B_INDEX='sparse+http://127.0.0.1:1/index.git' \ + cargo-1.80 logout --registry a + Logout not currently logged in to `a` + + * These reproduction steps apply to all affected toolchain versions, not just + cargo-1.80. + + [ Where problems could occur ] + + * The upstream patch affects only cargo-X.Y; no other binary packages are + affected. + + * After the patch, cargo now skips .git stripping and GitHub lowercasing for + any URL whose scheme contains '+'. In practice, that means + "sparse+http(s)://" registries. This means that any users which relied on old + behaviour may be affected: + + - If a user configured a sparse registry as ".../index.git" in one place and + ".../index" in another, then cargo will no longer treat those two URLs as + matching, potentially causing crate build failures. + + - If a user relied on an unusual Git URL scheme, such as "git+ssh://...", + then those URLs would no longer get ".git" stripped. This could also + potentially lead to such URLs being recognized as a different source. + + * As described in the test plan, the cherry-picked patch includes a new unit + test. If it starts failing then that could cause new Rust toolchain build + failures. + + * Internal compiler issues are unlikely, as this patch was cherry-picked + directly from the upstream Rust developers, and it has been included in newer + Rust toolchain releases for several versions now with no issues. + + * Additionally, this change does not impact archive package builds whatsoever. + Since dh-cargo replaces crates.io with a local directory, no such URLs are + used in Ubuntu/Debian package builds. There is no change to the behaviour of + cargo during archive package builds. + + [ Other Info ] + + * In debian/changelog I have included a changelog entry referencing the + disabling of the selfbuild autopkgtest for infrastructure reasons, + purposefully omitting the # on the bug number. This is because it is not + fixing an existing bug -- it is simply disabling a test which has been known + to make things flaky in the past, and including the bug number gives useful + context. + + * Since this CVE is low severity, I would deem it not being worthy of an upload + on its own, but considering there are other bugs which must be fixed + (LP: #2100266, LP: #2154209), I believe it makes sense to bundle this fix in + with the uploads too. + + * Instead of fixing every single Rust release on every single Ubuntu release, + we are targeting only the newest Rust release on every supported Ubuntu + release -- users on a given Ubuntu series can fix the issues by upgrading + their Rust toolchain version.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2165793 Title: CVE-2026-5222: Incorrect Cargo URL normalization To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rustc-1.74/+bug/2165793/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
