From 91b48d3732651acb661311e206ead587b685434c Mon Sep 17 00:00:00 2001 From: Daniel Thwaites Date: Mon, 2 Jun 2025 14:50:41 +0100 Subject: [PATCH] Report incorrect group information in users --- crates/users/RUSTSEC-0000-0000.md | 34 +++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 crates/users/RUSTSEC-0000-0000.md diff --git a/crates/users/RUSTSEC-0000-0000.md b/crates/users/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..ec350097c --- /dev/null +++ b/crates/users/RUSTSEC-0000-0000.md @@ -0,0 +1,34 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "users" +date = "2025-01-15" +url = "https://github.com/ogham/rust-users/issues/44" +categories = ["privilege-escalation"] + +[versions] +patched = [] +unaffected = ["< 0.8.0"] +``` + +# `root` appended to group listings + +Affected versions append `root` to group listings, unless the correct listing +has exactly 1024 groups. + +This affects both: + +- The supplementary groups of a user +- The group access list of the current process + +If the caller uses this information for access control, this may lead to +privilege escalation. + +This crate is not currently maintained, so a patched version is not available. + +Versions older than 0.8.0 do not contain the affected functions, so downgrading +to them is a workaround. + +## Recommended alternatives +- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) +- [`sysinfo`](https://crates.io/crates/sysinfo)