GHSA-FQ3W-P4FG-MW73低危已审查

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

OSV 1.4.0 · github-reviewed · 修改于 2026-06-26 02:00

发布时间

2026-06-26 02:00

GitHub 审查时间

2026-06-26 02:00

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-fq3w-p4fg-mw73/GHSA-fq3w-p4fg-mw73.json

公告说明

Impact

Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature. Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.

Patches

At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.

Workarounds

Do not run fuji manual on non-dev builds for versions <= 0.8.0.

Additional Information

This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

受影响的软件包

crates.io

fixurjavainstall

标识信息

别名 / CVE

无

CWE

CWE-489

软件生态

crates.io

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

原始 OSV JSON

{
  "id": "GHSA-fq3w-p4fg-mw73",
  "aliases": [],
  "details": "### Impact\nAffects: Anyone who generates the UNIX man pages in Fuji <= `0.8.0` build with the `dev` crate feature.\nConsequences: `/usr/share/man/man8` may be entirely removed & re-created without any of the previous entries.\n\n### Patches\nAt the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue.\nDue to the same unrelated publishing issue, no new GitHub Releases version has been released.\n\n### Workarounds\nDo not run `fuji manual` on non-`dev` builds for versions <= `0.8.0`.\n\n### Additional Information\nThis bug results from development-only code being accidentally left in for release use.\nPrevious versions of Fuji are still \"safe\" to use, provided that you do not run `fuji manual`.\nThere is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.",
  "summary": "fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.1"
            }
          ]
        }
      ],
      "package": {
        "name": "fixurjavainstall",
        "ecosystem": "crates.io"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 0.8.0"
      }
    }
  ],
  "modified": "2026-06-25T18:00:18Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
    }
  ],
  "published": "2026-06-25T18:00:18Z",
  "references": [
    {
      "url": "https://github.com/EpicVon2468/fixurjavainstall/security/advisories/GHSA-fq3w-p4fg-mw73",
      "type": "WEB"
    },
    {
      "url": "https://github.com/EpicVon2468/fixurjavainstall",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-489"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-25T18:00:18Z"
  }
}