Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

sccache

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3crates.ioPublished

    sccache vulnerable to privilege escalation if server is run as root

    CVE-2023-1521 · GHSA-x7fr-pg8f-93f5

    Affected
    • crates.io sccache < 0.4.0
    Fixed in
    0.4.0· Vendor fix available
    Issue
    Impact On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LDPRELOAD. If the server is run as root (which is the default when installing the snap package), this means a user running the sccache client can get root privileges. Patches Upgrade to 0.4.0 Workarounds Don't run sccache server as root. GitHub Security Lab number GHSL-2023-046

    Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →