# CVE-2021-28878: cargo: Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and...

CVE-2021-28878 is fixed in 18 products on 1 platform, first by libstd-rust-1.53 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1, released August 7, 2021. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-28878
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0200
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 11, 2021

## Description

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.  The following packages have been upgraded to a later upstream version: rust (1.52.1). (BZ#1953002)  Security Fix(es):  * rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323)  * rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context (CVE-2021-28875)  * rust: panic safety issue in Zip implementation (CVE-2021-28876)  * rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877)  * rust: memory safety violation in Zip implementation when next_back() and next() are used together (CVE-2021-28878)  * rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879)  * rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  For information on usage, see Using Rust Toolset linked in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cargo RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | cargo ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | cargo-doc RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | cargo-doc ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | clippy RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | clippy ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | libstd-rust-1.53 Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [libstd-rust-1.53 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libstd-rust-1.53-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | libstd-rust-1.53 Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [libstd-rust-1.53 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libstd-rust-1.53-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rls RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rls ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-all Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rust-all 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rust-all-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rust-all Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rust-all 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rust-all-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rust-analysis RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-analysis ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-clippy Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rust-clippy 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rust-clippy-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rust-clippy Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rust-clippy 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rust-clippy-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rust-debugger-common RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-debugger-common ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-doc RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-doc ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-gdb RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-gdb Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rust-gdb 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rust-gdb-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rust-gdb Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rust-gdb 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rust-gdb-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rust-gdb ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-lldb RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-lldb Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rust-lldb 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rust-lldb-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rust-lldb Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rust-lldb 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rust-lldb-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rust-lldb ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-src RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-src Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rust-src 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rust-src-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rust-src Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rust-src 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rust-src-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rust-src ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-std-static RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-std-static ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rust-toolset RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rust-toolset ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |
| Linux | rustc Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rustc 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rustc-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rustc Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rustc 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rustc-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rustfmt RHEL 8 | 0:1.52.1-1.module+el8.4.0+11282+0729bac9 | [RHSA-2021:3063](https://patchblox.com/security/data/fix/linux/rhsa-2021-3063.md) | Aug 10, 2021 |
| Linux | rustfmt Ubuntu 20.04 LTS (focal) | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | [rustfmt 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rustfmt-1.53.0-dfsg1-llvm-4ubuntu1-20.04.1.md) | Aug 7, 2021 |
| Linux | rustfmt Ubuntu 22.04.1 LTS (jammy) | 1.53.0+dfsg1+llvm-4ubuntu1 | [rustfmt 1.53.0+dfsg1+llvm-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rustfmt-1.53.0-dfsg1-llvm-4ubuntu1.md) | Aug 7, 2021 |
| Linux | rustfmt ol 8 | 0:1.52.1-1.module+el8.4.0+20287+5ada6442 | [ELSA-2021-3063](https://patchblox.com/security/data/fix/linux/elsa-2021-3063.md) | Aug 12, 2021 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.