CVE-2022-46176

CVE-2022-46176 affects Cargo, the Rust package manager, in all versions prior to 1.66.1. The vulnerability stems from Cargo's failure to perform SSH host key verification when cloning indexes and dependencies, including when git is configured to replace HTTPS connections with SSH. This oversight allows for potential man-in-the-middle (MITM) attacks, enabling an attacker to intercept or tamper with data during the cloning process. Rated with a CVSS score of 5.9 (MEDIUM), the attack vector is network-based with high attack complexity, requiring no user interaction. The primary impact is a high integrity loss, as an attacker could inject malicious code or compromise dependencies, though confidentiality and availability are not directly affected. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite this, the vulnerability has garnered significant community attention with two mentions in discussions and two media articles, indicating awareness within the cybersecurity community.