{"action":"Upgrade cargo to 0.65.0 or later.","affected":[{"fixed":"0.65.0","introduced":"0"},{"fixed":"0.67.0","introduced":"0.66.0"}],"component":"cargo","cve_ids":["CVE-2022-36113"],"ecosystem":"crates.io","epss":0.01207,"exploited":false,"fixed_versions":["0.65.0","0.67.0"],"ghsa_id":"GHSA-rfj2-q3h3-hm5j","id":"tcs_01M5KF326DBXH37RT34J22GTV8","modified_at":"2023-11-08T04:10:01.718706Z","published_at":"2022-09-16T17:12:30Z","references":["https://osv.dev/vulnerability/GHSA-rfj2-q3h3-hm5j","https://github.com/rust-lang/cargo/security/advisories/GHSA-rfj2-q3h3-hm5j","https://nvd.nist.gov/vuln/detail/CVE-2022-36113","https://github.com/rust-lang/cargo/commit/15f1e4b0bf4b4fc20369e0a85d9b77957c4dd52a","https://github.com/rust-lang/cargo/commit/97b80919e404b0768ea31ae329c3b4da54bed05a","https://github.com/rust-lang/cargo/commit/dafe4a7ea016739680ec7998aebe1bc6de131a5b","https://github.com/rust-lang/cargo","https://security.gentoo.org/glsa/202210-09"],"severity":{"label":"low","score":3.9},"sources":[{"source":"osv","source_id":"GHSA-rfj2-q3h3-hm5j","url":"https://osv.dev/vulnerability/GHSA-rfj2-q3h3-hm5j"}],"summary":"Cargo extracting malicious crates can corrupt arbitrary files"}