RUSTSEC-2026-0418: libz-sys build script leaks environment variables in the build directory
还没有人认领这个 Issue。
评估
调研方向
The issue describes a security advisory for libz-sys, but does not identify a change needed in numtracker or any affected files or tests. Start by checking how numtracker depends on libz-sys and whether the affected versions are present in its dependency tree. Done means confirming whether this repository needs a dependency update or other mitigation; the issue provides no repository-specific acceptance criteria.
由索引模型根据 Issue 内容生成。
描述
libz-sys build script leaks environment variables in the build directory
| Details | |
|---|---|
| Package | libz-sys |
| Version | 1.1.29 |
| URL | https://github.com/rust-lang/libz-sys/pull/280 |
| Date | 2026-10-28 |
| Patched versions | >=1.1.31 |
| Unaffected versions | <1.0.21 |
The build script of libz-sys version <= 1.1.30 prints the full environment
of the build, including any secrets it contains, to its stdout when compiled
with [email protected] or later on a Unix host. This affects any build that depends on
libz-sys. Cargo saves build script stdout under target/, so the values end
up in anything that stores or shares the target/ directory, such as CI caches.
This is similar to the Miri issue.
Details
To decide whether to link against a system zlib, the libz-sys build script
compiles a small test program with a compiler command from cc and logs it
with:
println!("running {:?}", cmd);
On Unix, Debug impl for std::process::Command prints every environment
variable explicitly set on the command. Before [email protected], its
Tool::to_command() set only a few compiler-specific variables. Starting with
[email protected] (released 2026-10-03), Tool::to_command() clears the environment
and sets every variable explicitly.
Cargo parses build script stdout for cargo: directives, and stores the full
output in the build directory. It also prints it with -vv.
The probe runs for a default libz-sys build, including when pkg-config finds
zlib, unless one of these applies:
- the target is Windows, Android, Haiku or OpenHarmony
- static linking is requested via the
staticfeature orLIBZ_SYS_STATIC=1 - the
zlib-ngfeatures are enabled withoutstock-zlib
Mitigations
Fixed in [email protected], which no longer logs the probe command.
If you cannot upgrade, here are some workarounds:
- Build with
LIBZ_SYS_STATIC=1or thestaticfeature, which skips the probe. - Pin
ccto a release before 1.6.0 (cargo update cc --precise <version>).
Note that upgrading libz-sys does not remove values already written. If an
affected build already ran with secrets in its environment, clear CI caches and
stored artifacts containing its
target/build directory,
and consider rotating those secrets.
See advisory page for additional details.
- 主要语言
- Rust
- 星标
- 2
- 派生
- 2
- 平均合并
- 13 小时 13 分钟
- 30 天内合并 PR
- 5
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
DiamondLightSource/numtracker 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 70/100
DiamondLightSource/numtracker#309 ·
-
难度 1/5 1 小时以内 新手友好度 82/100
DiamondLightSource/numtracker#278 ·
-
难度 1/5 1 小时以内 新手友好度 20/100
DiamondLightSource/numtracker#326 ·
-
难度 4/5 3-5 天 新手友好度 20/100
DiamondLightSource/numtracker#325 ·
-
RUSTSEC-2026-0387: Multiple timing variability issues in operations intended to be constant-time未关闭
难度 4/5 3-5 天 新手友好度 1/100
DiamondLightSource/numtracker#324 ·
查看 DiamondLightSource/numtracker 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
RustCrypto/utils#1597 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
max-sixty/worktrunk#4727 · 7 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 86/100
维护者通常 1 天内回复
-
follow-up
难度 2/5 1-3 小时 新手友好度 73/100
carrick-sh/carrick#1859 ·
维护者通常 1 天内回复