Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

fixurjavainstall

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.2crates.ioPublished

    fixurjavainstall: Previous Fuji versions can accidentally wipe /usr/share/man/man8

    GHSA-fq3w-p4fg-mw73

    Affected
    • crates.io fixurjavainstall <= 0.8.0
    Fixed in
    0.8.1· Vendor fix available
    Issue
    Impact Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature. Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries. Patches At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released. Workarounds Do not run fuji manual on non-dev builds for versions <= 0.8.0. Additional Information This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

    Recommended action: Upgrade to 0.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →