[Bug 2154209] Re: CVE-2026-5223: Crates in third party registries can override the cached source of other crates

[Finn Gärtner]

After updating the bug tasks I noticed that the table at
https://documentation.ubuntu.com/ubuntu-for-
developers/reference/availability/rust/#ubuntu-rust-deb-packages is
incorrect. I'll update it and recreate the bug tasks

** Also affects: rustc-1.92 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.91 (Ubuntu)
   Importance: Undecided
       Status: New

** No longer affects: rustc-1.93 (Ubuntu Trusty)

** No longer affects: rustc-1.93 (Ubuntu Questing)

** No longer affects: rustc-1.93 (Ubuntu Noble)

** No longer affects: rustc-1.93 (Ubuntu Jammy)

** No longer affects: rustc-1.93 (Ubuntu Focal)

** No longer affects: rustc-1.93 (Ubuntu Bionic)

** No longer affects: rustc-1.93 (Ubuntu Xenial)

** No longer affects: rustc-1.92 (Ubuntu Questing)

** No longer affects: rustc-1.92 (Ubuntu Noble)

** No longer affects: rustc-1.92 (Ubuntu Bionic)

** No longer affects: rustc-1.92 (Ubuntu Focal)

** No longer affects: rustc-1.92 (Ubuntu Jammy)

** No longer affects: rustc-1.92 (Ubuntu Xenial)

** No longer affects: rustc-1.92 (Ubuntu Trusty)

** No longer affects: rustc-1.91 (Ubuntu Noble)

** No longer affects: rustc-1.91 (Ubuntu Questing)

** No longer affects: rustc-1.91 (Ubuntu Bionic)

** No longer affects: rustc-1.91 (Ubuntu Jammy)

** No longer affects: rustc-1.91 (Ubuntu Focal)

** No longer affects: rustc-1.91 (Ubuntu Trusty)

** No longer affects: rustc-1.91 (Ubuntu Xenial)

** Also affects: rustc-1.88 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.85 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.82 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.81 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.80 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.79 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.78 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.77 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.76 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.74 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.62 (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.62 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.74 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.76 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.77 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.78 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.79 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.80 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.81 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.82 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.85 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.88 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.91 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.92 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.93 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.62 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.74 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.76 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.77 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.78 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.79 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.80 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.81 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.82 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.85 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.88 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.91 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.92 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.93 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.62 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.74 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.76 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.77 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.78 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.79 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.80 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.81 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.82 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.85 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.88 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.91 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.92 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: rustc-1.93 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** No longer affects: rustc-1.62 (Ubuntu Noble)

** No longer affects: rustc-1.62 (Ubuntu Questing)

** No longer affects: rustc-1.62 (Ubuntu Resolute)

** No longer affects: rustc-1.76 (Ubuntu Questing)

** No longer affects: rustc-1.76 (Ubuntu Resolute)

** No longer affects: rustc-1.74 (Ubuntu Resolute)

** No longer affects: rustc-1.74 (Ubuntu Questing)

** No longer affects: rustc-1.74 (Ubuntu Jammy)

** No longer affects: rustc-1.77 (Ubuntu Questing)

** No longer affects: rustc-1.77 (Ubuntu Resolute)

** No longer affects: rustc-1.78 (Ubuntu Questing)

** No longer affects: rustc-1.79 (Ubuntu Questing)

** No longer affects: rustc-1.80 (Ubuntu Questing)

** No longer affects: rustc-1.81 (Ubuntu Questing)

** No longer affects: rustc-1.82 (Ubuntu Resolute)

** No longer affects: rustc-1.78 (Ubuntu Resolute)

** No longer affects: rustc-1.82 (Ubuntu Questing)

** No longer affects: rustc-1.81 (Ubuntu Resolute)

** No longer affects: rustc-1.79 (Ubuntu Resolute)

** No longer affects: rustc-1.80 (Ubuntu Resolute)

** No longer affects: rustc-1.85 (Ubuntu Resolute)

** Also affects: rustc-1.84 (Ubuntu)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rustc-1.76 in Ubuntu.
Matching subscriptions: rustc-1.93
https://bugs.launchpad.net/bugs/2154209

Title:
  CVE-2026-5223: Crates in third party registries can override the
  cached source of other crates

Status in rustc-1.62 package in Ubuntu:
  New
Status in rustc-1.74 package in Ubuntu:
  New
Status in rustc-1.76 package in Ubuntu:
  New
Status in rustc-1.77 package in Ubuntu:
  New
Status in rustc-1.78 package in Ubuntu:
  New
Status in rustc-1.79 package in Ubuntu:
  New
Status in rustc-1.80 package in Ubuntu:
  New
Status in rustc-1.81 package in Ubuntu:
  New
Status in rustc-1.82 package in Ubuntu:
  New
Status in rustc-1.84 package in Ubuntu:
  New
Status in rustc-1.85 package in Ubuntu:
  New
Status in rustc-1.88 package in Ubuntu:
  New
Status in rustc-1.91 package in Ubuntu:
  New
Status in rustc-1.92 package in Ubuntu:
  New
Status in rustc-1.93 package in Ubuntu:
  In Progress
Status in rustc-1.62 source package in Jammy:
  New
Status in rustc-1.76 source package in Jammy:
  New
Status in rustc-1.77 source package in Jammy:
  New
Status in rustc-1.78 source package in Jammy:
  New
Status in rustc-1.79 source package in Jammy:
  New
Status in rustc-1.80 source package in Jammy:
  New
Status in rustc-1.81 source package in Jammy:
  New
Status in rustc-1.82 source package in Jammy:
  New
Status in rustc-1.85 source package in Jammy:
  New
Status in rustc-1.88 source package in Jammy:
  New
Status in rustc-1.91 source package in Jammy:
  New
Status in rustc-1.92 source package in Jammy:
  New
Status in rustc-1.93 source package in Jammy:
  New
Status in rustc-1.74 source package in Noble:
  New
Status in rustc-1.76 source package in Noble:
  New
Status in rustc-1.77 source package in Noble:
  New
Status in rustc-1.78 source package in Noble:
  New
Status in rustc-1.79 source package in Noble:
  New
Status in rustc-1.80 source package in Noble:
  New
Status in rustc-1.81 source package in Noble:
  New
Status in rustc-1.82 source package in Noble:
  New
Status in rustc-1.85 source package in Noble:
  New
Status in rustc-1.88 source package in Noble:
  New
Status in rustc-1.91 source package in Noble:
  New
Status in rustc-1.92 source package in Noble:
  New
Status in rustc-1.93 source package in Noble:
  New
Status in rustc-1.85 source package in Questing:
  New
Status in rustc-1.88 source package in Questing:
  New
Status in rustc-1.91 source package in Questing:
  New
Status in rustc-1.92 source package in Questing:
  New
Status in rustc-1.93 source package in Questing:
  New
Status in rustc-1.88 source package in Resolute:
  New
Status in rustc-1.91 source package in Resolute:
  New
Status in rustc-1.92 source package in Resolute:
  New
Status in rustc-1.93 source package in Resolute:
  New

Bug description:
  A full description of this CVE can be found on the rust-lang blog[1].

  Cargo incorrectly handles symlinks inside of crate tarballs downloaded
  from third-party registries, allowing malicious crates to override the
  source code of another crate from the same registry.

  Starting with Rust 1.96.0, extracting any symlink within crate
  tarballs shall be rejected, so any Rust version before that is
  affected.

  [1]: https://blog.rust-lang.org/2026/05/25/cve-2026-5223/

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rustc-1.62/+bug/2154209/+subscriptions