Description (CNA)
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0.8.0 before 0.11.1 |
| Red Hat / Red Hat OpenShift sandboxed containers 1.1 | unaffected sha256:a6f29da891174e57fcfd131da7aa90c50459ba24164111b83120a1b91f2eabba before * |
| Red Hat / Red Hat Enterprise Linux 10 | affected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | unaffected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat Trusted Profile Analyzer | affected |
CWE
CWE-266
References
- https://access.redhat.com/errata/RHSA-2025:12359
- https://access.redhat.com/security/cve/CVE-2025-5791
- https://bugzilla.redhat.com/show_bug.cgi?id=2370001
- https://crates.io/crates/users
- https://github.com/ogham/rust-users/issues/44
- https://rustsec.org/advisories/RUSTSEC-2025-0040.html
ADP enrichment
No English description supplied.
No references supplied.