Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

libz-sys

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    libz-sys build script leaks environment variables in the build directory

    GHSA-8p3x-q3q3-q3v5

    Affected
    • crates.io libz-sys >= 1.0.21, < 1.1.31
    Fixed in
    1.1.31· Vendor fix available
    Issue
    The build script of `libz-sys` version `). Note that upgrading `libz-sys` does not remove values already written. If an affected build already ran with secrets in its environment, clear CI caches and stored artifacts containing its target/build directory, and consider rotating those secrets.

    Recommended action: Upgrade to 1.1.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →