add post on CVE-2022-46176

Author: pietroalbini

posts/2023-01-10-cve-2022-46176.md

@@ -0,0 +1,68 @@
+---
+layout: post
+title: "Security advisory for Cargo (CVE-2022-46176)"
+author: The Rust Security Response WG
+---
+
+> This is a cross-post of [the official security advisory][advisory]. The
+> official advisory contains a signed version with our PGP key, as well.
+
+[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/v5cFFJ7T0RY
+
+The Rust Security Response WG was notified that Cargo did not perform SSH host
+key verification when cloning indexes and dependencies via SSH. An attacker
+could exploit this to perform man-in-the-middle (MITM) attacks.
+
+This vulnerability has been assigned CVE-2022-46176.
+
+## Overview
+
+When an SSH client establishes communication with a server, to prevent MITM
+attacks the client should check whether it already communicated with that
+server in the past and what the server's public key was back then. If the key
+changed since the last connection, the connection must be aborted as a MITM
+attack is likely taking place.
+
+It was discovered that Cargo never implemented such checks, and performed no
+validation on the server's public key, leaving Cargo users vulnerable to MITM
+attacks.
+
+## Affected Versions
+
+All Rust versions containing Cargo before 1.66.1 are vulnerable.
+
+Note that even if you don't explicitly use SSH for alternate registry indexes
+or crate dependencies, you might be affected by this vulnerability if you have
+configured git to replace HTTPS connections to GitHub with SSH (through git's
+[`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the
+crates.io index through SSH.
+
+## Mitigations
+
+We will be releasing Rust 1.66.1 today, 2023-01-10, changing Cargo to check the
+SSH host key and abort the connection if the server's public key is not already
+trusted. We recommend everyone to upgrade as soon as possible.
+
+Patch files for Rust 1.66.0 are also available [here][2] for custom-built
+toolchains.
+
+For the time being Cargo will not ask the user whether to trust a server's
+public key during the first connection. Instead, Cargo will show an error
+message detailing how to add that public key to the list of trusted keys. Note
+that this might break your automated builds if the hosts you clone dependencies
+or indexes from are not already trusted.
+
+## Acknowledgments
+
+Thanks to the Julia Security Team for disclosing this to us according to our
+[security policy][1]!
+
+We also want to thank the members of the Rust project who contributed to fixing
+this issue. Thanks to Eric Huss and Weihang Lo for writing and reviewing the
+patch, Pietro Albini for coordinating the disclosure and writing this advisory,
+and Josh Stone, Josh Triplett and Jacob Finkelman for advising during the
+disclosure.
+
+[1]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf
+[2]: https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2022-46176
+[3]: https://www.rust-lang.org/policies/security