GitHub Advisoryadvisory · crates.io
GHSA-f2wx-xjfw-xjv6 topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
LOW
Official page ↗
- Ecosystem
- crates.io
- Packages
- topgrade
- Severity
- Low
- Weaknesses
- CWE-367
- Reviewed
- 2023-07-17
Affected packages
• crates.io topgrade: < 12.0.1 → fixed in 12.0.1
Description
Summary
https://github.com/advisories/GHSA-mc8h-8q98-g5hr
https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead
`tempfile` v0.4.26 ships with affected `remove_dir_all` v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean `cargo audit`
Updating `tempfile` is warranted
Related
Weakness · CWE (1)
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness
References
- https://github.com/topgrade-rs/topgrade/security/advisories/GHSA-f2wx-xjfw-xjv6 web
- https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead web
- https://github.com/advisories/GHSA-mc8h-8q98-g5hr advisory
- https://github.com/topgrade-rs/topgrade package
- https://github.com/topgrade-rs/topgrade/releases/tag/v12.0.0 web