The remove_dir_all
crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all
function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.
Thanks to the Rust security team for identifying the problem and alerting us to it.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-366", "CWE-367" ], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2023-02-24T16:23:59Z" }