CVE ID:	CVE-2023-38497
Description:	Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
Test IDs:	1.3.6.1.4.1.25623.1.0.884630   1.3.6.1.4.1.25623.1.1.12.2023.6275.1   1.3.6.1.4.1.25623.1.0.884658   1.3.6.1.4.1.25623.1.0.833389
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2023-38497 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMEXGUGPW5OBSQA6URTBNDSU3RAEFOZ4/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGKE6PGM4HIQUHPJRBQAHMELINSGN4H4/ https://en.wikipedia.org/wiki/Umask https://en.wikipedia.org/wiki/Umask https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff https://github.com/rust-lang/cargo/pull/12443 https://github.com/rust-lang/cargo/pull/12443 https://github.com/rust-lang/cargo/security/advisories/GHSA-j3xp-wfr4-hx87 https://github.com/rust-lang/cargo/security/advisories/GHSA-j3xp-wfr4-hx87 https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497 https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497 https://www.rust-lang.org/policies/security https://www.rust-lang.org/policies/security