Add `cargo` CVEs 2022-36113 & 2022-36114

[pinkforest]

Background

Cargo has new CVEs: https://blog.rust-lang.org/2022/09/14/cargo-cves.html

• CVE-2022-36113 - GHSA-rfj2-q3h3-hm5j
• CVE-2022-36114 - GHSA-2hvr-h6gw-qrxp
• https://github.com/rust-lang/cargo/commit/d1f9553c825f6d7481453be8d58d0e7f117988a7
• https://github.com/rust-lang/cargo/commit/d87d57dbbda61754f4fab0f329a7ac520e062c46

There was a fix here: https://github.com/rust-lang/cargo/pull/11088 that targeted beta five days ago

It is possible there is a backport to 1.64.0 release

One problem is the GHSA went out before there was actionable fix and GHSA also targeted this against the cargo crate itself

Cargo is also used as a library so beyond the cargo binary itself GHSA targets the library

Real question here is..

Beyond the usual rust release CVEs e.g. cargo binary -

We hold should maybe add RustSec light up the cargo crate as a library re: CVE's ?

I haven't had time to go dig deep on this yet but if someone wants to take a stab at it..

Ref: https://github.com/rust-lang/wg-security-response/issues/10 - best to hold up merging for actionable fix maybe

[amousset]

I don't see why we could not add an advisory for cargo "the crate", and one for cargo the tool (in rust/cargo/), they are meant to be used in different contexts.

[tarcieri]

The advisories under crates and rust are also versioned differently:

• crates is versioned according to the crate release, e.g. 0.64 for cargo
• rust is versioned according to Rust release (e.g. 1.64.0)