CVE-2024-43402 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-43402 Interim 1 5 2025-04-30T23:35:49Z current 2024-09-05T23:11:32Z 2025-04-30T23:35:49Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-43402 Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For example, `.bat. .` is interpreted by Windows as `.bat`, but the original fix didn't check for that. Affected users who are using Rust 1.77.2 or greater can remove the trailing whitespace (ASCII 0x20) and trailing periods (ASCII 0x2E) from the batch file name to bypass the incomplete fix and enable the mitigations. Users are affected if their code or one of their dependencies invoke a batch script on Windows with trailing whitespace or trailing periods in the name, and pass untrusted arguments to it. Rust 1.81.0 will update the standard library to apply the CVE-2024-24576 mitigations to all batch files invocations, regardless of the trailing chars in the file name. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 cargo cargo1.79 cargo1.80 clippy rls rust rust-analysis rust-gdb rust-src rust-std rust-std-static rust1.79 rust1.80 rust1.80-src rustfmt cargo as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS clippy as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rls as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rust as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rust-analysis as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rust-src as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rust-std-static as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS rustfmt as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS cargo as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rls as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rust as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rust-gdb as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS cargo as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS rust as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS cargo as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS rust as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS cargo as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 rust as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 cargo1.79 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 rust1.79 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 cargo1.80 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 rust1.80 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 rust1.80-src as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 cargo as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 rust as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 cargo1.79 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 rust1.79 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 cargo1.80 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 rust1.80 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 rust1.80-src as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 cargo as a component of SUSE Linux Enterprise Server 15 SP1-LTSS clippy as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rls as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rust as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rust-analysis as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rust-src as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rust-std-static as a component of SUSE Linux Enterprise Server 15 SP1-LTSS rustfmt as a component of SUSE Linux Enterprise Server 15 SP1-LTSS cargo as a component of SUSE Linux Enterprise Server 15 SP2-LTSS clippy as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rls as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rust as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rust-analysis as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rust-src as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rust-std-static as a component of SUSE Linux Enterprise Server 15 SP2-LTSS rustfmt as a component of SUSE Linux Enterprise Server 15 SP2-LTSS cargo as a component of SUSE Linux Enterprise Server 15 SP3-LTSS rls as a component of SUSE Linux Enterprise Server 15 SP3-LTSS rust as a component of SUSE Linux Enterprise Server 15 SP3-LTSS rust-gdb as a component of SUSE Linux Enterprise Server 15 SP3-LTSS cargo as a component of SUSE Linux Enterprise Server 15 SP4-LTSS rust as a component of SUSE Linux Enterprise Server 15 SP4-LTSS rust-analysis as a component of SUSE Linux Enterprise Server 15 SP4-LTSS cargo as a component of SUSE Linux Enterprise Server 15-LTSS clippy as a component of SUSE Linux Enterprise Server 15-LTSS rls as a component of SUSE Linux Enterprise Server 15-LTSS rust as a component of SUSE Linux Enterprise Server 15-LTSS rust-analysis as a component of SUSE Linux Enterprise Server 15-LTSS rust-gdb as a component of SUSE Linux Enterprise Server 15-LTSS rust-src as a component of SUSE Linux Enterprise Server 15-LTSS rust-std as a component of SUSE Linux Enterprise Server 15-LTSS rust-std-static as a component of SUSE Linux Enterprise Server 15-LTSS rustfmt as a component of SUSE Linux Enterprise Server 15-LTSS rust as a component of SUSE Linux Enterprise Server Teradata 15 SP4 cargo as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 clippy as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rls as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rust as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rust-analysis as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rust-src as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rust-std-static as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 rustfmt as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 cargo as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rls as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rust as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rust-gdb as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 cargo as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 rust as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 rust-analysis as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 cargo as a component of openSUSE Leap 15.5 rust as a component of openSUSE Leap 15.5 cargo1.79 as a component of openSUSE Leap 15.5 rust1.79 as a component of openSUSE Leap 15.5 cargo1.80 as a component of openSUSE Leap 15.5 rust1.80 as a component of openSUSE Leap 15.5 rust1.80-src as a component of openSUSE Leap 15.5 cargo as a component of openSUSE Leap 15.6 rust as a component of openSUSE Leap 15.6 cargo1.79 as a component of openSUSE Leap 15.6 rust1.79 as a component of openSUSE Leap 15.6 cargo1.80 as a component of openSUSE Leap 15.6 rust1.80 as a component of openSUSE Leap 15.6 rust1.80-src as a component of openSUSE Leap 15.6 Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For example, `.bat. .` is interpreted by Windows as `.bat`, but the original fix didn't check for that. Affected users who are using Rust 1.77.2 or greater can remove the trailing whitespace (ASCII 0x20) and trailing periods (ASCII 0x2E) from the batch file name to bypass the incomplete fix and enable the mitigations. Users are affected if their code or one of their dependencies invoke a batch script on Windows with trailing whitespace or trailing periods in the name, and pass untrusted arguments to it. Rust 1.81.0 will update the standard library to apply the CVE-2024-24576 mitigations to all batch files invocations, regardless of the trailing chars in the file name. CVE-2024-43402 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:cargo SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:clippy SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rls SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rust SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rust-analysis SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rust-src SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rust-std-static SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:rustfmt SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:cargo SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rls SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rust SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rust-gdb SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:cargo SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:rust SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:cargo SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:rust SUSE Linux Enterprise Module for Development Tools 15 SP5:cargo SUSE Linux Enterprise Module for Development Tools 15 SP5:cargo1.79 SUSE Linux Enterprise Module for Development Tools 15 SP5:cargo1.80 SUSE Linux Enterprise Module for Development Tools 15 SP5:rust SUSE Linux Enterprise Module for Development Tools 15 SP5:rust1.79 SUSE Linux Enterprise Module for Development Tools 15 SP5:rust1.80 SUSE Linux Enterprise Module for Development Tools 15 SP5:rust1.80-src SUSE Linux Enterprise Module for Development Tools 15 SP6:cargo SUSE Linux Enterprise Module for Development Tools 15 SP6:cargo1.79 SUSE Linux Enterprise Module for Development Tools 15 SP6:cargo1.80 SUSE Linux Enterprise Module for Development Tools 15 SP6:rust SUSE Linux Enterprise Module for Development Tools 15 SP6:rust1.79 SUSE Linux Enterprise Module for Development Tools 15 SP6:rust1.80 SUSE Linux Enterprise Module for Development Tools 15 SP6:rust1.80-src SUSE Linux Enterprise Server 15 SP1-LTSS:cargo SUSE Linux Enterprise Server 15 SP1-LTSS:clippy SUSE Linux Enterprise Server 15 SP1-LTSS:rls SUSE Linux Enterprise Server 15 SP1-LTSS:rust SUSE Linux Enterprise Server 15 SP1-LTSS:rust-analysis SUSE Linux Enterprise Server 15 SP1-LTSS:rust-src SUSE Linux Enterprise Server 15 SP1-LTSS:rust-std-static SUSE Linux Enterprise Server 15 SP1-LTSS:rustfmt SUSE Linux Enterprise Server 15 SP2-LTSS:cargo SUSE Linux Enterprise Server 15 SP2-LTSS:clippy SUSE Linux Enterprise Server 15 SP2-LTSS:rls SUSE Linux Enterprise Server 15 SP2-LTSS:rust SUSE Linux Enterprise Server 15 SP2-LTSS:rust-analysis SUSE Linux Enterprise Server 15 SP2-LTSS:rust-src SUSE Linux Enterprise Server 15 SP2-LTSS:rust-std-static SUSE Linux Enterprise Server 15 SP2-LTSS:rustfmt SUSE Linux Enterprise Server 15 SP3-LTSS:cargo SUSE Linux Enterprise Server 15 SP3-LTSS:rls SUSE Linux Enterprise Server 15 SP3-LTSS:rust SUSE Linux Enterprise Server 15 SP3-LTSS:rust-gdb SUSE Linux Enterprise Server 15 SP4-LTSS:cargo SUSE Linux Enterprise Server 15 SP4-LTSS:rust SUSE Linux Enterprise Server 15 SP4-LTSS:rust-analysis SUSE Linux Enterprise Server 15-LTSS:cargo SUSE Linux Enterprise Server 15-LTSS:clippy SUSE Linux Enterprise Server 15-LTSS:rls SUSE Linux Enterprise Server 15-LTSS:rust SUSE Linux Enterprise Server 15-LTSS:rust-analysis SUSE Linux Enterprise Server 15-LTSS:rust-gdb SUSE Linux Enterprise Server 15-LTSS:rust-src SUSE Linux Enterprise Server 15-LTSS:rust-std SUSE Linux Enterprise Server 15-LTSS:rust-std-static SUSE Linux Enterprise Server 15-LTSS:rustfmt SUSE Linux Enterprise Server Teradata 15 SP4:rust SUSE Linux Enterprise Server for SAP Applications 15 SP2:cargo SUSE Linux Enterprise Server for SAP Applications 15 SP2:clippy SUSE Linux Enterprise Server for SAP Applications 15 SP2:rls SUSE Linux Enterprise Server for SAP Applications 15 SP2:rust SUSE Linux Enterprise Server for SAP Applications 15 SP2:rust-analysis SUSE Linux Enterprise Server for SAP Applications 15 SP2:rust-src SUSE Linux Enterprise Server for SAP Applications 15 SP2:rust-std-static SUSE Linux Enterprise Server for SAP Applications 15 SP2:rustfmt SUSE Linux Enterprise Server for SAP Applications 15 SP3:cargo SUSE Linux Enterprise Server for SAP Applications 15 SP3:rls SUSE Linux Enterprise Server for SAP Applications 15 SP3:rust SUSE Linux Enterprise Server for SAP Applications 15 SP3:rust-gdb SUSE Linux Enterprise Server for SAP Applications 15 SP4:cargo SUSE Linux Enterprise Server for SAP Applications 15 SP4:rust SUSE Linux Enterprise Server for SAP Applications 15 SP4:rust-analysis openSUSE Leap 15.5:cargo openSUSE Leap 15.5:cargo1.79 openSUSE Leap 15.5:cargo1.80 openSUSE Leap 15.5:rust openSUSE Leap 15.5:rust1.79 openSUSE Leap 15.5:rust1.80 openSUSE Leap 15.5:rust1.80-src openSUSE Leap 15.6:cargo openSUSE Leap 15.6:cargo1.79 openSUSE Leap 15.6:cargo1.80 openSUSE Leap 15.6:rust openSUSE Leap 15.6:rust1.79 openSUSE Leap 15.6:rust1.80 openSUSE Leap 15.6:rust1.80-src important 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H