From c2e8f1f1d2c1f77f27d080e9a255d481a7e4add1 Mon Sep 17 00:00:00 2001 From: Daniel Thwaites Date: Wed, 15 Jan 2025 02:13:07 +0000 Subject: [PATCH] Report incorrect group information in users --- crates/users/RUSTSEC-0000-0000.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 crates/users/RUSTSEC-0000-0000.md diff --git a/crates/users/RUSTSEC-0000-0000.md b/crates/users/RUSTSEC-0000-0000.md new file mode 100644 index 0000000000..7de6f26603 --- /dev/null +++ b/crates/users/RUSTSEC-0000-0000.md @@ -0,0 +1,25 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "users" +date = "2025-01-15" +url = "https://github.com/ogham/rust-users/issues/44" +categories = ["privilege-escalation"] + +[versions] +patched = [] +unaffected = ["<= 0.7.0"] +``` + +# `root` appended to group listings + +Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups. + +This affects both: + +- The supplementary groups of a user +- The group access list of the current process + +If the caller uses this information for access control, this may lead to privilege escalation. + +This crate is not currently maintained, so a patched version is not available.