Skip to content
Fencer Intel
low —

GHSA-fq3w-p4fg-mw73 json

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

published 4mo ago modified 4mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact Affects: Anyone who generates the UNIX man pages in Fuji <= `0.8.0` build with the `dev` crate feature. Consequences: `/usr/share/man/man8` may be entirely removed & re-created without any of the previous entries.

### Patches At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.

### Workarounds Do not run `fuji manual` on non-`dev` builds for versions <= `0.8.0`.

### Additional Information This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run `fuji manual`. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

Patch / fix

  • crates.io fixurjavainstall 0.8.1

Is GHSA-fq3w-p4fg-mw73 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io fixurjavainstall
<0.8.1
0.8.1

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.