GHSA-f2wx-xjfw-xjv6

Source

https://github.com/advisories/GHSA-f2wx-xjfw-xjv6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-f2wx-xjfw-xjv6/GHSA-f2wx-xjfw-xjv6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f2wx-xjfw-xjv6

Published

2023-07-17T18:21:58Z

Modified

2023-07-17T18:21:58Z

Summary

topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Details

Summary

https://github.com/advisories/GHSA-mc8h-8q98-g5hr https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead

tempfile v0.4.26 ships with affected remove_dir_all v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean cargo audit

Updating tempfile is warranted

Database specific

{
    "cwe_ids":  [
        "CWE-367"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-17T18:21:58Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

crates.io / topgrade

Package

Name: topgrade; View open source insights on deps.dev
Purl: pkg:cargo/topgrade

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

12.0.1

Database specific

last_known_affected_version_range

"<= 12.0.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-f2wx-xjfw-xjv6/GHSA-f2wx-xjfw-xjv6.json"