RUSTSEC-2026-0418: libz-sys build script leaks environment variables in the build directory

Ouverte
  • Quelque chose ne va pas ?
#329 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
45/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
rust
Domaine
backend, security

Piste de recherche

The issue describes a security advisory for libz-sys, but does not identify a change needed in numtracker or any affected files or tests. Start by checking how numtracker depends on libz-sys and whether the affected versions are present in its dependency tree. Done means confirming whether this repository needs a dependency update or other mitigation; the issue provides no repository-specific acceptance criteria.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

libz-sys build script leaks environment variables in the build directory

Details
Package libz-sys
Version 1.1.29
URL https://github.com/rust-lang/libz-sys/pull/280
Date 2026-10-28
Patched versions >=1.1.31
Unaffected versions <1.0.21

The build script of libz-sys version <= 1.1.30 prints the full environment
of the build, including any secrets it contains, to its stdout when compiled
with [email protected] or later on a Unix host. This affects any build that depends on
libz-sys. Cargo saves build script stdout under target/, so the values end
up in anything that stores or shares the target/ directory, such as CI caches.

This is similar to the Miri issue.

Details

To decide whether to link against a system zlib, the libz-sys build script
compiles a small test program with a compiler command from cc and logs it
with:

println!(&quot;running {:?}&quot;, cmd);

On Unix, Debug impl for std::process::Command prints every environment
variable explicitly set on the command. Before [email protected], its
Tool::to_command() set only a few compiler-specific variables. Starting with
[email protected] (released 2026-10-03), Tool::to_command() clears the environment
and sets every variable explicitly.

Cargo parses build script stdout for cargo: directives, and stores the full
output in the build directory. It also prints it with -vv.

The probe runs for a default libz-sys build, including when pkg-config finds
zlib, unless one of these applies:

  • the target is Windows, Android, Haiku or OpenHarmony
  • static linking is requested via the static feature or LIBZ_SYS_STATIC=1
  • the zlib-ng features are enabled without stock-zlib

Mitigations

Fixed in [email protected], which no longer logs the probe command.

If you cannot upgrade, here are some workarounds:

  • Build with LIBZ_SYS_STATIC=1 or the static feature, which skips the probe.
  • Pin cc to a release before 1.6.0 (cargo update cc --precise &lt;version&gt;).

Note that upgrading libz-sys does not remove values already written. If an
affected build already ran with secrets in its environment, clear CI caches and
stored artifacts containing its
target/build directory,
and consider rotating those secrets.

See advisory page for additional details.

Langage dominant
Rust
Étoiles
2
Forks
2
Merge moyen
13 h 13 min
PR mergées (30 j)
5

Préparer son environnement

  • Fournit un Dockerfile ou un fichier Docker Compose
  • Aucun modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de DiamondLightSource/numtracker

Toutes les issues de DiamondLightSource/numtracker

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.