[<prev] [day] [month] [year] [list]
Message-ID: <0a4343db-8de2-4d2e-b2b5-0c3913d795f3@oracle.com>
Date: Fri, 1 May 2026 18:27:43 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Security audit of rust-coreutils
https://discourse.ubuntu.com/t/an-update-on-rust-coreutils/80773
announces the results of a security audit of the rust-coreutils
package by Zellic. The Audit Report is published at:
https://github.com/Zellic/publications/blob/master/uutils%20coreutils%20-%20Zellic%20Audit%20Report.pdf
The summary of the Audit Report states:
> During our assessment on the scoped uutils coreutils targets, we discovered
> 73 findings. Seven critical issues were found. Eleven were of high impact,
> 29 were of medium impact, and 26 were of low impact.
The Ubuntu summary notes that the above report covered the first round,
"the most security-sensitive tools in the coreutils suite", and that a
second round on the remaining utilities turned up 40 more issues, reported
in the form of pull requests to the upstream repo, listed on:
https://github.com/uutils/coreutils/pulls?q=is%3Apr+label%3Areported-canonical-2
It also says the bulk of the issues are fixed in the upstream 0.8.0 release,
and links to the many CVE ids issued for this work.
https://corrode.dev/blog/bugs-rust-wont-catch/ adds some further analysis
of the issues and suggestions for other rust projects to follow.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
