Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

uu_mkfifo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1crates.ioPublished

    mkfifo: permissions of an existing file are changed after FIFO creation fails

    CVE-2026-35341 · GHSA-pmf6-rcx4-v53v

    Affected
    • crates.io uu_mkfifo < 0.6.0
    Fixed in
    0.6.0· Vendor fix available
    Issue
    When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::setpermissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask - 0644). Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error. Remediation: Acknowledged by Canonical; fixed in PR #10376. --- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic. Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

    Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →