Merge pull request #1055 from chriswailes/ndk-update-announcement

Announce an impending update the Android NDK target

Author: Mark-Simulacrum

posts/2023-01-09-android-ndk-update-r25.md

@@ -0,0 +1,28 @@
+---
+layout: post
+title: "Updating the Android NDK in Rust 1.68"
+author: Android Platform Team
+description: "Modernizing Android support in Rust"
+---
+
+We are pleased to announce that Android platform support in Rust will be
+modernized in Rust 1.68 as we update the target NDK from r17 to r25.  As a
+consequence the minimum supported API level will increase from 15 (Ice Cream
+Sandwich) to 19 (KitKat).
+
+In NDK r23 Android switched to using LLVM's `libunwind` for all architectures.
+This meant that
+1. If a project were to target NDK r23 or newer with previous versions of Rust
+   [a workaround](https://github.com/rust-lang/rust/pull/85806#issuecomment-1096266946)
+   would be required to redirect attempts to link against `libgcc` to instead
+   link against `libunwind`.  Following this update this workaround will no
+   longer be necessary.
+2. If a project uses NDK r22 or older it will need to be updated to use [r23 or
+   newer](https://developer.android.com/ndk/downloads).  Information about the
+   layout of the NDK's toolchain can be found
+   [here](https://developer.android.com/ndk/guides/other_build_systems).
+
+Going forward the Android platform will target the most recent LTS NDK, allowing
+Rust developers to access platform features sooner.  These updates should occur
+yearly and will be announced in release notes.
+

posts/2023-01-10-cve-2022-46176.md

@@ -0,0 +1,68 @@
+---
+layout: post
+title: "Security advisory for Cargo (CVE-2022-46176)"
+author: The Rust Security Response WG
+---
+
+> This is a cross-post of [the official security advisory][advisory]. The
+> official advisory contains a signed version with our PGP key, as well.
+
+[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/v5cFFJ7T0RY
+
+The Rust Security Response WG was notified that Cargo did not perform SSH host
+key verification when cloning indexes and dependencies via SSH. An attacker
+could exploit this to perform man-in-the-middle (MITM) attacks.
+
+This vulnerability has been assigned CVE-2022-46176.
+
+## Overview
+
+When an SSH client establishes communication with a server, to prevent MITM
+attacks the client should check whether it already communicated with that
+server in the past and what the server's public key was back then. If the key
+changed since the last connection, the connection must be aborted as a MITM
+attack is likely taking place.
+
+It was discovered that Cargo never implemented such checks, and performed no
+validation on the server's public key, leaving Cargo users vulnerable to MITM
+attacks.
+
+## Affected Versions
+
+All Rust versions containing Cargo before 1.66.1 are vulnerable.
+
+Note that even if you don't explicitly use SSH for alternate registry indexes
+or crate dependencies, you might be affected by this vulnerability if you have
+configured git to replace HTTPS connections to GitHub with SSH (through git's
+[`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the
+crates.io index through SSH.
+
+## Mitigations
+
+We will be releasing Rust 1.66.1 today, 2023-01-10, changing Cargo to check the
+SSH host key and abort the connection if the server's public key is not already
+trusted. We recommend everyone to upgrade as soon as possible.
+
+Patch files for Rust 1.66.0 are also available [here][2] for custom-built
+toolchains.
+
+For the time being Cargo will not ask the user whether to trust a server's
+public key during the first connection. Instead, Cargo will show an error
+message detailing how to add that public key to the list of trusted keys. Note
+that this might break your automated builds if the hosts you clone dependencies
+or indexes from are not already trusted.
+
+## Acknowledgments
+
+Thanks to the Julia Security Team for disclosing this to us according to our
+[security policy][1]!
+
+We also want to thank the members of the Rust project who contributed to fixing
+this issue. Thanks to Eric Huss and Weihang Lo for writing and reviewing the
+patch, Pietro Albini for coordinating the disclosure and writing this advisory,
+and Josh Stone, Josh Triplett and Jacob Finkelman for advising during the
+disclosure.
+
+[1]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf
+[2]: https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2022-46176
+[3]: https://www.rust-lang.org/policies/security