CVE-2022-46176 — Rust-lang Cargo vulnerability

Vendor	Product	Version range	Fixed in
debian	cargo	< cargo 0.66.0+ds1-1 (bookworm)	cargo 0.66.0+ds1-1 (bookworm)
debian	rust-cargo	< cargo 0.66.0+ds1-1 (bookworm)	cargo 0.66.0+ds1-1 (bookworm)
msrc	azl3_rust_1.75.0-14_on_azure_linux_3.0	—	—
msrc	azl3_rust_1.86.0-1_on_azure_linux_3.0	—	—
msrc	cbl2_rust_1.68.2-1_on_cbl_mariner_2.0	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
msrc	cm1_rust_1.59.0-1_on_cbl_mariner_1.0	—	—
rust-lang	cargo	<= 0.67.0	—
rust-lang	cargo	>= 0 < 0.66.0+ds1-1	0.66.0+ds1-1
rust-lang	cargo	>= 0 < 0.67.1	0.67.1

Red Hat

rust-cargo: cargo lacking ssh host key checking

vendor_redhat·2023-01-10·CVSS 5.3

CVE-2022-46176 [MEDIUM] CWE-347 rust-cargo: cargo lacking ssh host key checking rust-cargo: cargo lacking ssh host key checking Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url..insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host ke

Microsoft

Cargo did not verify SSH host keys

vendor_msrc·2023-01-10·CVSS 5.3

CVE-2022-46176 [MEDIUM] CWE-347 Cargo did not verify SSH host keys Cargo did not verify SSH host keys FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner GitHub_M: GitHub_M Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://learn.microsoft.com/

Debian

CVE-2022-46176: cargo - Cargo is a Rust package manager. The Rust Security Response WG was notified that...

vendor_debian·2022·CVSS 5.3

CVE-2022-46176 [MEDIUM] CVE-2022-46176: cargo - Cargo is a Rust package manager. The Rust Security Response WG was notified that... Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url..insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public

OSV

git2 Rust package suppresses ssh host key checking

osv·2023-01-12

git2 Rust package suppresses ssh host key checking git2 Rust package suppresses ssh host key checking By default, when accessing an ssh repository (ie via an `ssh:` git repository url) the git2 Rust package does not do any host key checking. Additionally, the provided API is not sufficient for a an application to do meaningful checking itself. ## Impact When connecting to an ssh repository, and when an attacker can redirect the connection (performing a malice-in-the-middle attack) an affected application might: * Receive git objects and branches controlled by the attacker, exposing the local system (and whatever happens next) to malicious data. In many circumstances, this could readily lead to privilege escalation. * Erroneously send git objects to the attacker, rather than to the intended recipient. If the information is not suppose

OSV

CVE-2022-46176: Cargo is a Rust package manager

osv·2023-01-11·CVSS 5.9

CVE-2022-46176 [MEDIUM] CVE-2022-46176: Cargo is a Rust package manager Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url..insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public

OSV

Cargo did not verify SSH host keys

osv·2023-01-10·CVSS 5.9

CVE-2022-46176 [MEDIUM] Cargo did not verify SSH host keys Cargo did not verify SSH host keys The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. ## Overview When an SSH client establishes communication with a server, to prevent MITM attacks the client should check whether it already communicated with that server in the past and what the server's public key was back then. If the key changed since the last connection, the connection must be aborted as a MITM attack is likely taking place. It was discovered that Cargo never implemented such checks, and performed no validation on the server's public key, leaving Cargo users vulne

GHSA

Cargo did not verify SSH host keys

ghsa·2023-01-10·CVSS 5.9

CVE-2022-46176 [MEDIUM] CWE-347 Cargo did not verify SSH host keys Cargo did not verify SSH host keys The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. ## Overview When an SSH client establishes communication with a server, to prevent MITM attacks the client should check whether it already communicated with that server in the past and what the server's public key was back then. If the key changed since the last connection, the connection must be aborted as a MITM attack is likely taking place. It was discovered that Cargo never implemented such checks, and performed no validation on the server's public key, leaving Cargo users vulne

CVE-2022-46176: Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and…

Affected

CVSS provenance