Source: rust-coreutils X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for rust-coreutils. CVE-2026-35370[0]: | The id utility in uutils coreutils miscalculates the groups= section | of its output. The implementation uses a user's real GID instead of | their effective GID to compute the group list, leading to | potentially divergent output compared to GNU coreutils. Because many | scripts and automated processes rely on the output of id to make | security-critical access-control or permission decisions, this | discrepancy can lead to unauthorized access or security | misconfigurations. https://github.com/uutils/coreutils/issues/10006 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-35370 https://www.cve.org/CVERecord?id=CVE-2026-35370 Please adjust the affected versions in the BTS as needed.
