[Pkg-rust-maintainers] Bug#1136199: rust-coreutils: CVE-2026-35370

[Moritz Mühlenhoff]

Source: rust-coreutils
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rust-coreutils.

CVE-2026-35370[0]:
| The id utility in uutils coreutils miscalculates the groups= section
| of its output. The implementation uses a user's real GID instead of
| their effective GID to compute the group list, leading to
| potentially divergent output compared to GNU coreutils. Because many
| scripts and automated processes rely on the output of id to make
| security-critical access-control or permission decisions, this
| discrepancy can lead to unauthorized access or security
| misconfigurations.

https://github.com/uutils/coreutils/issues/10006


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35370
    https://www.cve.org/CVERecord?id=CVE-2026-35370

Please adjust the affected versions in the BTS as needed.