Security advisory for Cargo (CVE-2022-46176)

[Pietro Albini]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The Rust Security Response WG was notified that Cargo did not perform SSH host
key verification when cloning indexes and dependencies via SSH. An attacker
could exploit this to perform man-in-the-middle (MITM) attacks.

This vulnerability has been assigned CVE-2022-46176.

## Overview

When an SSH client establishes communication with a server, to prevent MITM
attacks the client should check whether it already communicated with that
server in the past and what the server's public key was back then. If the key
changed since the last connection, the connection must be aborted as a MITM
attack is likely taking place.

It was discovered that Cargo never implemented such checks, and performed no
validation on the server's public key, leaving Cargo users vulnerable to MITM
attacks.

## Affected Versions

All Rust versions containing Cargo before 1.66.1 are vulnerable.

Note that even if you don't explicitly use SSH for alternate registry indexes
or crate dependencies, you might be affected by this vulnerability if you have
configured git to replace HTTPS connections to GitHub with SSH (through git's
[`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the
crates.io index through SSH.

## Mitigations

We will be releasing Rust 1.66.1 today, 2023-01-10, changing Cargo to check the
SSH host key and abort the connection if the server's public key is not already
trusted. We recommend everyone to upgrade as soon as possible.

Patch files for Rust 1.66.0 are also available [here][2] for custom-built
toolchains.

For the time being Cargo will not ask the user whether to trust a server's
public key during the first connection. Instead, Cargo will show an error
message detailing how to add that public key to the list of trusted keys. Note
that this might break your automated builds if the hosts you clone dependencies
or indexes from are not already trusted.

## Acknowledgments

Thanks to the Julia Security Team for disclosing this to us according to our
[security policy][1]!

We also want to thank the members of the Rust project who contributed to fixing
this issue. Thanks to Eric Huss and Weihang Lo for writing and reviewing the
patch, Pietro Albini for coordinating the disclosure and writing this advisory,
and Josh Stone, Josh Triplett and Jacob Finkelman for advising during the
disclosure.

[1]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf
[2]: https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2022-46176
[3]: https://www.rust-lang.org/policies/security
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEV2nIi/XdPRSiNKes77mGCudSDawFAmO9P+kACgkQ77mGCudS
Dax2XRAAr3lcAyVphS3Wm8kTKEAtnE4rpWvQnlebMcXO0HF2vNtW3srxJxcyInvm
dAS6EUah7qe71uwDMeqw6HIqcrLDESoaWFxwyruBHwfP+yQl4xSshnFtk9x1HDtm
cj66y2NWA726Z0RKWaZ6ePZ95tubnhMPbbMQJq7IYBCSRV5OPr4e51B9du30iGad
3yxd55mhcMaFViRvdVBDEgQYEN9hWGTzUodITfYyGTeYc7XP//4w9lzOTdW2u20P
9THdLwCNx6YYPSPMOr/UMAqmcPiqq5iLBfKd/aM+OAab4C1866RNnL40PBYv2lkb
M3y/oyDL1Ffe6oh/PqoaTIl0TOXdbZ6nElLDiLbZfMKraMJYh4Ue2viEf97DYQ3m
Kzske/lgdpiLT5LSXK2cUpXiCtKphu5pjqjoZZmfaXQfEZfQ8Jnpiu/xX36OTQ9q
UuKnqS6tCg3PWld/05rQDNKxQSqMZiyQH2qe81sJNlpB0gxjYdb0H2BOF0Iz7tcI
bxeFFdB7WXyB/CsSO5M+zW9j8ltT05goOmo/ja04z5UPp9mIeGTSDjynCQPhceqm
6akhQzA0PyzmlZI5VPOUtc2zmU05cLcqtcU7eHaIfgNoxFtakbh+p0bkJJQwIGMV
U0w/FDNeVXfCdTMcuxK99hEvxnYK2q4/6K9cyVGKoEjJXRIgyTk=
=1E15
-----END PGP SIGNATURE-----