{"action":"Upgrade cargo to 0.72.2 or later.","affected":[{"fixed":"0.72.2","introduced":"0"}],"component":"cargo","cve_ids":["CVE-2023-38497"],"ecosystem":"crates.io","epss":0.00702,"exploited":false,"fixed_versions":["0.72.2"],"ghsa_id":"GHSA-j3xp-wfr4-hx87","id":"tcs_01M5KF0V56WTCXBNZXXSYN08Y9","modified_at":"2023-11-08T04:13:08.062181Z","published_at":"2023-08-03T16:30:52Z","references":["https://osv.dev/vulnerability/GHSA-j3xp-wfr4-hx87","https://github.com/rust-lang/cargo/security/advisories/GHSA-j3xp-wfr4-hx87","https://nvd.nist.gov/vuln/detail/CVE-2023-38497","https://github.com/rust-lang/cargo/pull/12443","https://github.com/rust-lang/cargo/commit/d78bbf4bde3c6b95caca7512f537c6f9721426ff","https://en.wikipedia.org/wiki/Umask","https://github.com/rust-lang/cargo","https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGKE6PGM4HIQUHPJRBQAHMELINSGN4H4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMEXGUGPW5OBSQA6URTBNDSU3RAEFOZ4","https://www.rust-lang.org/policies/security"],"severity":{"label":"high","score":7.9},"sources":[{"source":"osv","source_id":"GHSA-j3xp-wfr4-hx87","url":"https://osv.dev/vulnerability/GHSA-j3xp-wfr4-hx87"}],"summary":"Cargo not respecting umask when extracting crate archives"}