Business information leak In cargo
Description
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is low, due to the extremely niche requirements needed to achieve the attack.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | =0.47.0-3 || =0.57.0-1 || =0.57.0-2 || =0.57.0-3 || =0.57.0-4 || =0.57.0-5 || =0.57.0-6 || =0.57.0-7 || =0.62.0ubuntu1-0ubuntu2+ports || =0.63.1-1 || =0.63.1-2 || =0.63.1-3 || =0.66.0+ds1-1 || =0.66.0+ds2-1 || =0.66.0+ds2-2 || =0.66.0-1 || =0.70.1+ds1-1 || =0.70.1+ds1-1~exp1 || =0.70.1+ds1-2 || =0.70.1+ds1-3 || =0.70.1-1~exp1 | - | |
debian 11 | =0.43.1-4 || =0.57.0-1 || =0.57.0-2 || =0.63.1-1 || =0.63.1-2 || =0.66.0-1 || =0.66.0-2 || =0.66.0-3 || =0.66.0-4 || =0.66.0-5 || =0.66.0-6 || =0.70.1-1 || =0.70.1-2 || =0.70.1-3 || =0.76.0-1 || =0.76.0-2 || =0.76.0-3 || =0.76.0-4 || =0.81.0-1 || =0.81.0-2 || =0.81.0-3 || =0.82.0-1 || =0.83.0-1 || =0.83.0-2 || =0.84.0-1 || =0.85.0-1 || =0.86.0-1 || =0.86.0-2 || =0.86.0-3 || =0.86.0-4 || =0.91.0-1 || =0.91.0-2 || =0.91.0-3 | - | |
debian 12 | =0.66.0-1 || =0.66.0-2 || =0.66.0-3 || =0.66.0-4 || =0.66.0-5 || =0.66.0-6 || =0.70.1-1 || =0.70.1-2 || =0.70.1-3 || =0.76.0-1 || =0.76.0-2 || =0.76.0-3 || =0.76.0-4 || =0.81.0-1 || =0.81.0-2 || =0.81.0-3 || =0.82.0-1 || =0.83.0-1 || =0.83.0-2 || =0.84.0-1 || =0.85.0-1 || =0.86.0-1 || =0.86.0-2 || =0.86.0-3 || =0.86.0-4 || =0.91.0-1 || =0.91.0-2 || =0.91.0-3 | - | |
debian 13 | =0.86.0-2 || =0.86.0-3 || =0.86.0-4 || =0.91.0-1 || =0.91.0-2 || =0.91.0-3 | - | |
debian 14 | =0.86.0-2 || =0.86.0-3 || =0.86.0-4 || =0.91.0-1 || =0.91.0-2 || >=0 <0.91.0-3 | 0.91.0-3 | |
debian 12 | =0.66.0+ds1-1 || =0.66.0+ds2-1 || =0.66.0+ds2-2 || =0.70.1+ds1-1 || =0.70.1+ds1-1~exp1 || =0.70.1+ds1-2 || =0.70.1+ds1-3 || =0.70.1-1~exp1 | - | |
debian 12 | =1.63.0+dfsg1-2 || =1.64.0+dfsg1-1 || =1.64.0+dfsg1-1~exp1 || =1.64.0+dfsg1-1~exp2 || =1.64.0+dfsg1-1~exp3 || =1.64.0+dfsg1-1~exp4 || =1.65.0+dfsg1-1 || =1.65.0+dfsg1-1~exp1 || =1.65.0+dfsg1-1~exp2 || =1.65.0+dfsg1-1~exp3 || =1.65.0+dfsg1-2 || =1.66.0+dfsg1-1 || =1.66.0+dfsg1-1~exp1 || =1.67.1+dfsg1-1 || =1.67.1+dfsg1-1~exp1 || =1.68.2+dfsg1-1 || =1.68.2+dfsg1-1~exp1 || =1.69.0+dfsg1-1 || =1.69.0+dfsg1-1~exp1 || =1.69.0+dfsg1-1~exp2 || =1.70.0+dfsg1-1 || =1.70.0+dfsg1-1~exp1 || =1.70.0+dfsg1-1~exp2 || =1.70.0+dfsg1-1~exp3 || =1.70.0+dfsg1-2 || =1.70.0+dfsg1-2~exp1 || =1.70.0+dfsg1-3 || =1.70.0+dfsg1-4 || =1.70.0+dfsg1-5 || =1.70.0+dfsg1-6 || =1.70.0+dfsg1-7 || =1.70.0+dfsg1-8 || =1.70.0+dfsg1-8.1 || =1.70.0+dfsg1-9 || =1.70.0+dfsg2-1 || =1.70.0+dfsg2-1+loong64 || =1.70.0+dfsg2-1~exp1 || =1.70.0+dfsg2-1~exp2 || =1.70.0+dfsg2-1~exp3 || =1.71.1+dfsg1-1 || =1.71.1+dfsg1-1~exp1 || =1.71.1+dfsg1-1~exp2 || =1.71.1+dfsg1-2 || =1.72.1+dfsg1-1 || =1.72.1+dfsg1-1+hurd.1 || =1.72.1+dfsg1-1~exp1 || =1.72.1+dfsg1-1~exp2 || =1.73.0+dfsg1-1 || =1.73.0+dfsg1-1+hurd.1 || =1.73.0+dfsg1-1+loong64 || =1.73.0+dfsg1-1~exp1 || =1.74.1+dfsg1-1 || =1.74.1+dfsg1-1+hurd.1 || =1.74.1+dfsg1-1~exp1 || =1.75.0+dfsg1-1 || =1.75.0+dfsg1-1~exp1 || =1.75.0+dfsg1-2 || =1.75.0+dfsg1-3 || =1.75.0+dfsg1-4 || =1.75.0+dfsg1-4+hurd.1 || =1.75.0+dfsg1-5 || =1.76.0+dfsg1-1 || =1.76.0+dfsg1-1+hurd.1 || =1.76.0+dfsg1-1~exp1 || =1.77.2+dfsg1-1 || =1.77.2+dfsg1-1~exp1 || =1.78.0+dfsg1-1~exp1 || =1.78.0+dfsg1-2 || =1.79.0+dfsg1-1 || =1.79.0+dfsg1-1~exp1 || =1.79.0+dfsg1-2 || =1.79.0+dfsg1-2+hurd.1 || =1.80.0+dfsg1-1~exp1 || =1.80.1+dfsg1-1 || =1.80.1+dfsg1-1+hurd.1 || =1.80.1+dfsg1-1~exp1 || =1.81.0+dfsg1-1 || =1.81.0+dfsg1-1~exp1 || =1.81.0+dfsg1-1~exp2 || =1.81.0+dfsg1-2 || =1.82.0+dfsg1-1 || =1.82.0+dfsg1-1~exp1 || =1.82.0+dfsg1-1~exp2 || =1.82.0+dfsg1-1~exp3 || =1.82.0+dfsg1-2 || =1.83.0+dfsg1-1 || =1.83.0+dfsg1-1~exp1 || =1.84.0+dfsg1-1 || =1.84.0+dfsg1-1~exp1 || =1.84.0+dfsg1-2 || =1.85.0+dfsg1-1 || =1.85.0+dfsg2-1 || =1.85.0+dfsg2-2 || =1.85.0+dfsg2-3 || =1.85.0+dfsg3-1 || =1.85.0~beta.9+dfsg1-1~exp1 || =1.86.0+dfsg1-1 || =1.86.0+dfsg1-1~bpo13+1 || =1.86.0+dfsg1-1~bpo13+2 || =1.86.0+dfsg1-1~exp1 || =1.86.0+dfsg1-1~exp2 || =1.86.0+dfsg1-1~exp2+x32 || =1.86.0+dfsg1-1~exp3 || =1.86.0+dfsg1-1~exp4 || =1.87.0+dfsg1-1 || =1.87.0+dfsg1-1~bpo13+1 || =1.87.0+dfsg1-1~bpo13+2 || =1.87.0+dfsg1-1~exp1 || =1.88.0+dfsg1-1 || =1.88.0+dfsg1-1~exp1 || =1.88.0+dfsg1-2 || =1.88.0+dfsg1-2~bpo13+1 || =1.89.0+dfsg1-1 || =1.89.0+dfsg1-1~bpo13+1 || =1.89.0+dfsg1-1~bpo13+2 || =1.89.0+dfsg1-1~exp1 || =1.90.0+dfsg1-1 || =1.90.0+dfsg1-1~bpo13+1 || =1.90.0+dfsg1-1~bpo13+2 || =1.90.0+dfsg1-1~exp1 || =1.91.1+dfsg1-1 || =1.91.1+dfsg1-1~bpo13+1 || =1.91.1+dfsg1-1~bpo13+2 || =1.91.1+dfsg1-1~exp1 || =1.91.1+dfsg1-1~exp2 || =1.91.1+dfsg1-1~exp3 || =1.92.0+dfsg1-1 || =1.92.0+dfsg1-1~exp1 || =1.92.0+dfsg1-2 || =1.92.0+dfsg1-2~bpo13+1 || =1.93.1+dfsg1-1 || =1.93.1+dfsg1-1~exp1 || =1.93.1+dfsg1-2 || =1.93.1+dfsg1-2~bpo13+1 || =1.94.1+dfsg1-1 || =1.94.1+dfsg1-1~bpo13+1 || =1.94.1+dfsg1-1~bpo13+2 || =1.94.1+dfsg1-1~bpo13+3 || =1.94.1+dfsg1-1~exp1 || =1.94.1+dfsg1-1~exp2 || =1.94.1+dfsg1-1~exp3 || =1.95.0+dfsg1-1 || =1.95.0+dfsg1-2 | - | |
debian 14 | =1.85.0+dfsg3-1 || =1.86.0+dfsg1-1 || =1.86.0+dfsg1-1~bpo13+1 || =1.86.0+dfsg1-1~bpo13+2 || =1.86.0+dfsg1-1~exp1 || =1.86.0+dfsg1-1~exp2 || =1.86.0+dfsg1-1~exp2+x32 || =1.86.0+dfsg1-1~exp3 || =1.86.0+dfsg1-1~exp4 || =1.87.0+dfsg1-1 || =1.87.0+dfsg1-1~bpo13+1 || =1.87.0+dfsg1-1~bpo13+2 || =1.87.0+dfsg1-1~exp1 || =1.88.0+dfsg1-1 || =1.88.0+dfsg1-1~exp1 || =1.88.0+dfsg1-2 || =1.88.0+dfsg1-2~bpo13+1 || =1.89.0+dfsg1-1 || =1.89.0+dfsg1-1~bpo13+1 || =1.89.0+dfsg1-1~bpo13+2 || =1.89.0+dfsg1-1~exp1 || =1.90.0+dfsg1-1 || =1.90.0+dfsg1-1~bpo13+1 || =1.90.0+dfsg1-1~bpo13+2 || =1.90.0+dfsg1-1~exp1 || =1.91.1+dfsg1-1 || =1.91.1+dfsg1-1~bpo13+1 || =1.91.1+dfsg1-1~bpo13+2 || =1.91.1+dfsg1-1~exp1 || =1.91.1+dfsg1-1~exp2 || =1.91.1+dfsg1-1~exp3 || =1.92.0+dfsg1-1 || =1.92.0+dfsg1-1~exp1 || =1.92.0+dfsg1-2 || =1.92.0+dfsg1-2~bpo13+1 || =1.93.1+dfsg1-1 || =1.93.1+dfsg1-1~exp1 || =1.93.1+dfsg1-2 || =1.93.1+dfsg1-2~bpo13+1 || =1.94.1+dfsg1-1 || =1.94.1+dfsg1-1~bpo13+1 || =1.94.1+dfsg1-1~bpo13+2 || =1.94.1+dfsg1-1~bpo13+3 || =1.94.1+dfsg1-1~exp1 || =1.94.1+dfsg1-1~exp2 || =1.94.1+dfsg1-1~exp3 || =1.95.0+dfsg1-1 || =1.95.0+dfsg1-2 | - | |
debian 13 | =1.85.0+dfsg3-1 || =1.86.0+dfsg1-1 || =1.86.0+dfsg1-1~bpo13+1 || =1.86.0+dfsg1-1~bpo13+2 || =1.86.0+dfsg1-1~exp1 || =1.86.0+dfsg1-1~exp2 || =1.86.0+dfsg1-1~exp2+x32 || =1.86.0+dfsg1-1~exp3 || =1.86.0+dfsg1-1~exp4 || =1.87.0+dfsg1-1 || =1.87.0+dfsg1-1~bpo13+1 || =1.87.0+dfsg1-1~bpo13+2 || =1.87.0+dfsg1-1~exp1 || =1.88.0+dfsg1-1 || =1.88.0+dfsg1-1~exp1 || =1.88.0+dfsg1-2 || =1.88.0+dfsg1-2~bpo13+1 || =1.89.0+dfsg1-1 || =1.89.0+dfsg1-1~bpo13+1 || =1.89.0+dfsg1-1~bpo13+2 || =1.89.0+dfsg1-1~exp1 || =1.90.0+dfsg1-1 || =1.90.0+dfsg1-1~bpo13+1 || =1.90.0+dfsg1-1~bpo13+2 || =1.90.0+dfsg1-1~exp1 || =1.91.1+dfsg1-1 || =1.91.1+dfsg1-1~bpo13+1 || =1.91.1+dfsg1-1~bpo13+2 || =1.91.1+dfsg1-1~exp1 || =1.91.1+dfsg1-1~exp2 || =1.91.1+dfsg1-1~exp3 || =1.92.0+dfsg1-1 || =1.92.0+dfsg1-1~exp1 || =1.92.0+dfsg1-2 || =1.92.0+dfsg1-2~bpo13+1 || =1.93.1+dfsg1-1 || =1.93.1+dfsg1-1~exp1 || =1.93.1+dfsg1-2 || =1.93.1+dfsg1-2~bpo13+1 || =1.94.1+dfsg1-1 || =1.94.1+dfsg1-1~bpo13+1 || =1.94.1+dfsg1-1~bpo13+2 || =1.94.1+dfsg1-1~bpo13+3 || =1.94.1+dfsg1-1~exp1 || =1.94.1+dfsg1-1~exp2 || =1.94.1+dfsg1-1~exp3 || =1.95.0+dfsg1-1 || =1.95.0+dfsg1-2 | - | |
debian 11 | =1.48.0+dfsg1-2 || =1.49.0+dfsg1-1 || =1.49.0+dfsg1-1~exp1 || =1.49.0+dfsg1-2 || =1.49.0~beta.4+dfsg1-1~exp1 || =1.50.0+dfsg1-1 || =1.50.0+dfsg1-1~exp1 || =1.50.0+dfsg1-1~exp2 || =1.50.0+dfsg1-1~exp3 || =1.50.0+dfsg1-1~exp4 || =1.51.0+dfsg1-1 || =1.51.0+dfsg1-1~exp1 || =1.51.0+dfsg1-1~exp2 || =1.51.0+dfsg1-1~exp3 || =1.52.0+dfsg1-1~exp1 || =1.52.0~beta.3+dfsg1-1~exp1 || =1.52.0~beta.3+dfsg1-1~exp2 || =1.52.0~beta.3+dfsg1-1~exp3 || =1.52.0~beta.3+dfsg1-1~exp4 || =1.52.1+dfsg1-1 || =1.52.1+dfsg1-1~exp1 || =1.52.1+dfsg1-1~exp2 || =1.52.1+dfsg1-1~exp3 || =1.53.0+dfsg1-1 || =1.53.0+dfsg1-1~exp1 || =1.53.0+dfsg1-2 || =1.53.0+dfsg1-3 || =1.53.0+dfsg1-4 || =1.54.0+dfsg1-1 || =1.54.0+dfsg1-1~exp1 || =1.54.0+dfsg1-2 || =1.54.0+dfsg1-3 || =1.55.0+dfsg1-0 || =1.55.0+dfsg1-1 || =1.55.0+dfsg1-1~exp1 || =1.55.0+dfsg1-2 || =1.56.0+dfsg1-1 || =1.56.0+dfsg1-2 || =1.56.0~beta.4+dfsg1-1~exp1 || =1.56.0~beta.4+dfsg1-1~exp2 || =1.57.0+dfsg1-1 || =1.57.0+dfsg1-1~exp1 || =1.58.1+dfsg1-1 || =1.58.1+dfsg1-1~exp1 || =1.59.0+dfsg1-1 || =1.59.0+dfsg1-1~exp1 || =1.59.0+dfsg1-2 || =1.60.0+dfsg1-1 || =1.60.0+dfsg1-1~exp1 || =1.61.0+dfsg1-1 || =1.61.0+dfsg1-1~exp1 || =1.61.0+dfsg1-2 || =1.62.1+dfsg1-1 || =1.62.1+dfsg1-1~exp1 || =1.63.0+dfsg1-1 || =1.63.0+dfsg1-1~exp1 || =1.63.0+dfsg1-2 || =1.64.0+dfsg1-1 || =1.64.0+dfsg1-1~exp1 || =1.64.0+dfsg1-1~exp2 || =1.64.0+dfsg1-1~exp3 || =1.64.0+dfsg1-1~exp4 || =1.65.0+dfsg1-1 || =1.65.0+dfsg1-1~exp1 || =1.65.0+dfsg1-1~exp2 || =1.65.0+dfsg1-1~exp3 || =1.65.0+dfsg1-2 || =1.66.0+dfsg1-1 || =1.66.0+dfsg1-1~exp1 || =1.67.1+dfsg1-1 || =1.67.1+dfsg1-1~exp1 || =1.68.2+dfsg1-1 || =1.68.2+dfsg1-1~exp1 || =1.69.0+dfsg1-1 || =1.69.0+dfsg1-1~exp1 || =1.69.0+dfsg1-1~exp2 || =1.70.0+dfsg1-1 || =1.70.0+dfsg1-1~exp1 || =1.70.0+dfsg1-1~exp2 || =1.70.0+dfsg1-1~exp3 || =1.70.0+dfsg1-2 || =1.70.0+dfsg1-2~exp1 || =1.70.0+dfsg1-3 || =1.70.0+dfsg1-4 || =1.70.0+dfsg1-5 || =1.70.0+dfsg1-6 || =1.70.0+dfsg1-7 || =1.70.0+dfsg1-8 || =1.70.0+dfsg1-8.1 || =1.70.0+dfsg1-9 || =1.70.0+dfsg2-1 || =1.70.0+dfsg2-1+loong64 || =1.70.0+dfsg2-1~exp1 || =1.70.0+dfsg2-1~exp2 || =1.70.0+dfsg2-1~exp3 || =1.71.1+dfsg1-1 || =1.71.1+dfsg1-1~exp1 || =1.71.1+dfsg1-1~exp2 || =1.71.1+dfsg1-2 || =1.72.1+dfsg1-1 || =1.72.1+dfsg1-1+hurd.1 || =1.72.1+dfsg1-1~exp1 || =1.72.1+dfsg1-1~exp2 || =1.73.0+dfsg1-1 || =1.73.0+dfsg1-1+hurd.1 || =1.73.0+dfsg1-1+loong64 || =1.73.0+dfsg1-1~exp1 || =1.74.1+dfsg1-1 || =1.74.1+dfsg1-1+hurd.1 || =1.74.1+dfsg1-1~exp1 || =1.75.0+dfsg1-1 || =1.75.0+dfsg1-1~exp1 || =1.75.0+dfsg1-2 || =1.75.0+dfsg1-3 || =1.75.0+dfsg1-4 || =1.75.0+dfsg1-4+hurd.1 || =1.75.0+dfsg1-5 || =1.76.0+dfsg1-1 || =1.76.0+dfsg1-1+hurd.1 || =1.76.0+dfsg1-1~exp1 || =1.77.2+dfsg1-1 || =1.77.2+dfsg1-1~exp1 || =1.78.0+dfsg1-1~exp1 || =1.78.0+dfsg1-2 || =1.79.0+dfsg1-1 || =1.79.0+dfsg1-1~exp1 || =1.79.0+dfsg1-2 || =1.79.0+dfsg1-2+hurd.1 || =1.80.0+dfsg1-1~exp1 || =1.80.1+dfsg1-1 || =1.80.1+dfsg1-1+hurd.1 || =1.80.1+dfsg1-1~exp1 || =1.81.0+dfsg1-1 || =1.81.0+dfsg1-1~exp1 || =1.81.0+dfsg1-1~exp2 || =1.81.0+dfsg1-2 || =1.82.0+dfsg1-1 || =1.82.0+dfsg1-1~exp1 || =1.82.0+dfsg1-1~exp2 || =1.82.0+dfsg1-1~exp3 || =1.82.0+dfsg1-2 || =1.83.0+dfsg1-1 || =1.83.0+dfsg1-1~exp1 || =1.84.0+dfsg1-1 || =1.84.0+dfsg1-1~exp1 || =1.84.0+dfsg1-2 || =1.85.0+dfsg1-1 || =1.85.0+dfsg2-1 || =1.85.0+dfsg2-2 || =1.85.0+dfsg2-3 || =1.85.0+dfsg3-1 || =1.85.0~beta.9+dfsg1-1~exp1 || =1.86.0+dfsg1-1 || =1.86.0+dfsg1-1~bpo13+1 || =1.86.0+dfsg1-1~bpo13+2 || =1.86.0+dfsg1-1~exp1 || =1.86.0+dfsg1-1~exp2 || =1.86.0+dfsg1-1~exp2+x32 || =1.86.0+dfsg1-1~exp3 || =1.86.0+dfsg1-1~exp4 || =1.87.0+dfsg1-1 || =1.87.0+dfsg1-1~bpo13+1 || =1.87.0+dfsg1-1~bpo13+2 || =1.87.0+dfsg1-1~exp1 || =1.88.0+dfsg1-1 || =1.88.0+dfsg1-1~exp1 || =1.88.0+dfsg1-2 || =1.88.0+dfsg1-2~bpo13+1 || =1.89.0+dfsg1-1 || =1.89.0+dfsg1-1~bpo13+1 || =1.89.0+dfsg1-1~bpo13+2 || =1.89.0+dfsg1-1~exp1 || =1.90.0+dfsg1-1 || =1.90.0+dfsg1-1~bpo13+1 || =1.90.0+dfsg1-1~bpo13+2 || =1.90.0+dfsg1-1~exp1 || =1.91.1+dfsg1-1 || =1.91.1+dfsg1-1~bpo13+1 || =1.91.1+dfsg1-1~bpo13+2 || =1.91.1+dfsg1-1~exp1 || =1.91.1+dfsg1-1~exp2 || =1.91.1+dfsg1-1~exp3 || =1.92.0+dfsg1-1 || =1.92.0+dfsg1-1~exp1 || =1.92.0+dfsg1-2 || =1.92.0+dfsg1-2~bpo13+1 || =1.93.1+dfsg1-1 || =1.93.1+dfsg1-1~exp1 || =1.93.1+dfsg1-2 || =1.93.1+dfsg1-2~bpo13+1 || =1.94.1+dfsg1-1 || =1.94.1+dfsg1-1~bpo13+1 || =1.94.1+dfsg1-1~bpo13+2 || =1.94.1+dfsg1-1~bpo13+3 || =1.94.1+dfsg1-1~exp1 || =1.94.1+dfsg1-1~exp2 || =1.94.1+dfsg1-1~exp3 || =1.95.0+dfsg1-1 || =1.95.0+dfsg1-2 | - |
1-10 of 11
10
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.