Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[master] Fix for CVE-2022-36113 and CVE-2022-36114 #11089

Merged
merged 5 commits into from
Sep 14, 2022
Merged

[master] Fix for CVE-2022-36113 and CVE-2022-36114 #11089

merged 5 commits into from
Sep 14, 2022

Commits on Sep 14, 2022

  1. CVE-2022-36113: avoid unpacking .cargo-ok from the crate

    @joshtriplett @pietroalbini
    joshtriplett authored and pietroalbini committed Sep 14, 2022
    Configuration menu
    Copy the full SHA
    97b8091 View commit details
    Browse the repository at this point in the history

  2. CVE-2022-36113: add tests

    @weihanglo @pietroalbini
    weihanglo authored and pietroalbini committed Sep 14, 2022
    Configuration menu
    Copy the full SHA
    dafe4a7 View commit details
    Browse the repository at this point in the history

  3. CVE-2022-36114: limit the maximum unpacked size of a crate to 512MB 

    This gives users of custom registries the same protections, using the
same size limit that crates.io uses.

`LimitErrorReader` code copied from crates.io.
    @joshtriplett @pietroalbini
    joshtriplett authored and pietroalbini committed Sep 14, 2022
    Configuration menu
    Copy the full SHA
    d1f9553 View commit details
    Browse the repository at this point in the history

  4. CVE-2022-36114: add tests

    @weihanglo @pietroalbini
    weihanglo authored and pietroalbini committed Sep 14, 2022
    Configuration menu
    Copy the full SHA
    d87d57d View commit details
    Browse the repository at this point in the history

  5. fix formatting

    @pietroalbini
    pietroalbini committed Sep 14, 2022
    Configuration menu
    Copy the full SHA
    0bf436d View commit details
    Browse the repository at this point in the history