RUSTSEC-2026-0418: libz-sys build script leaks environment variables in the build directory

Chiusa
  • Qualcosa non va?
#1,395 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Una pull request collegata è già stata integrata.

  • #1396 di @sentry-junior — integrata

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
build-system, security

Direzione di ricerca

Start by checking whether the workspace's Cargo.lock resolves libz-sys to a version below 1.1.31, and whether any Cargo.toml pins cc or libz-sys directly. Read the RUSTSEC advisory linked in the issue to confirm the patched range. Done when libz-sys resolves to 1.1.31 or later (or the affected build path is confirmed unreachable) and the workspace builds and its tests pass.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Rust

libz-sys build script leaks environment variables in the build directory

Details
Package libz-sys
Version 1.1.30
URL https://github.com/rust-lang/libz-sys/pull/280
Date 2026-10-28
Patched versions >=1.1.31
Unaffected versions <1.0.21

The build script of libz-sys version <= 1.1.30 prints the full environment
of the build, including any secrets it contains, to its stdout when compiled
with [email protected] or later on a Unix host. This affects any build that depends on
libz-sys. Cargo saves build script stdout under target/, so the values end
up in anything that stores or shares the target/ directory, such as CI caches.

This is similar to the Miri issue.

Details

To decide whether to link against a system zlib, the libz-sys build script
compiles a small test program with a compiler command from cc and logs it
with:

println!(&quot;running {:?}&quot;, cmd);

On Unix, Debug impl for std::process::Command prints every environment
variable explicitly set on the command. Before [email protected], its
Tool::to_command() set only a few compiler-specific variables. Starting with
[email protected] (released 2026-10-03), Tool::to_command() clears the environment
and sets every variable explicitly.

Cargo parses build script stdout for cargo: directives, and stores the full
output in the build directory. It also prints it with -vv.

The probe runs for a default libz-sys build, including when pkg-config finds
zlib, unless one of these applies:

  • the target is Windows, Android, Haiku or OpenHarmony
  • static linking is requested via the static feature or LIBZ_SYS_STATIC=1
  • the zlib-ng features are enabled without stock-zlib

Mitigations

Fixed in [email protected], which no longer logs the probe command.

If you cannot upgrade, here are some workarounds:

  • Build with LIBZ_SYS_STATIC=1 or the static feature, which skips the probe.
  • Pin cc to a release before 1.6.0 (cargo update cc --precise &lt;version&gt;).

Note that upgrading libz-sys does not remove values already written. If an
affected build already ran with secrets in its environment, clear CI caches and
stored artifacts containing its
target/build directory,
and consider rotating those secrets.

See advisory page for additional details.

Lingua principale
Rust
Stelle
754
Fork
192
Merge medio
2g 23h
PR unite (30g)
20

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di getsentry/sentry-rust

Tutte le issue di getsentry/sentry-rust

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.