RUSTSEC-2021-0133 cargo-download is unmaintained
The unmaintained cargo-download crate produces corrupted crates, requiring developers to switch to standard tools like wget or curl.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is RUSTSEC-2021-0133?
RUSTSEC-2021-0133 is a vulnerability in cargo-download, published on 25 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The cargo download subcommand (via cargo-download crate) is broken and maintainer has disappeared from GitHub and hasn't had any commits for a year.
Using this downloader will result to corrupted crates.
Maintainer has not responded to maintenance takeover.
Just use wget / curl directly.
Which versions are affected by RUSTSEC-2021-0133?
1 open source package ship an affected version, including cargo-download.
| Package | Affected | Fixed in |
|---|---|---|
cargo-download crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2021-0133?
No fix has been published for RUSTSEC-2021-0133 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2021-0133 being exploited?
There is no known exploitation of RUSTSEC-2021-0133 in the wild and no public exploit code.