{"id":"CVE-2022-21658","aliases":["ALSA-2022:1894","AZL-8337","BELL-CVE-2022-21658","DEBIAN-CVE-2022-21658","EUVD-2022-26876","GHSA-r9cc-f5pr-p3j2","MGASA-2022-0044","RHSA-2022:1894","RLSA-2022:1894","SUSE-SU-2022:0149-1","SUSE-SU-2022:0171-1","SUSE-SU-2022:0175-1","SUSE-SU-2022:0200-1","SUSE-SU-2022:0491-1","SUSE-SU-2022:0843-1","UBUNTU-CVE-2022-21658","openSUSE-SU-2022:0149-1","openSUSE-SU-2022:0171-1","openSUSE-SU-2022:0175-1","openSUSE-SU-2022:0491-1","openSUSE-SU-2022:0843-1","openSUSE-SU-2024:11767-1","openSUSE-SU-2024:11768-1","openSUSE-SU-2024:11769-1"],"status":"published","title":"Race condition in std::fs::remove_dir_all in rustlang","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01376,"percentile":0.72279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-363","CWE-367"],"published":"2022-01-20T00:00:00Z","modified":"2026-10-29T11:01:17Z","exploits":[{"source":"pocgithub","id":"sagittarius-a/cve-2022-21658","title":"sagittarius-a/cve-2022-21658","date":"2022-01-21","url":"https://github.com/sagittarius-a/cve-2022-21658"}],"fixes":[{"ecosystem":"AlmaLinux:8","package":"cargo","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cargo-doc","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"clippy","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rls","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-analysis","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-debugger-common","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-doc","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-gdb","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-lldb","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-src","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-std-static","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-std-static-wasm32-unknown-unknown","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-std-static-wasm32-wasi","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-toolset","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rustfmt","fixed_in":["1.58.1-1.module_el8.6.0+2748+176088b3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rust","fixed_in":["1.59.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rustc","fixed_in":["1.57.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rustc","fixed_in":["1.57.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rustc","fixed_in":["1.57.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"rust","fixed_in":["1.57.0-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-debuginfo","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-doc","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy-debuginfo","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls-debuginfo","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-analysis","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugger-common","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debuginfo","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugsource","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-doc","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-gdb","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-lldb","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-src","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static-wasm32-unknown-unknown","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static-wasm32-wasi","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-toolset","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt-debuginfo","fixed_in":["0:1.58.1-1.module+el8.6.0+14021+586eff1a"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rust","fixed_in":["0:1.58.1-1.module+el8.6.0+826+60f85975"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rust-toolset","fixed_in":["0:1.58.1-1.module+el8.6.0+826+60f85975"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.56","fixed_in":["1.56.1-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.55","fixed_in":["1.55.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.57","fixed_in":["1.57.0-150300.7.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rust","fixed_in":["1.53.0-3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rust","fixed_in":["1.53.0-3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rust","fixed_in":["1.53.0-3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rust","fixed_in":["1.53.0-3.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"rust","fixed_in":["1.53.0-22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust","fixed_in":["1.59.0-150300.21.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.58","fixed_in":["1.58.0-150300.7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.59","fixed_in":["1.59.0-150300.7.4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rustc","fixed_in":["1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"libredwg","fixed_in":["0.12.5-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libredwg","fixed_in":["0.12.5-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rust1.56","fixed_in":["1.56.1-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rust1.55","fixed_in":["1.55.0-150300.7.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rust1.57","fixed_in":["1.57.0-150300.7.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rust","fixed_in":["1.53.0-22.1","1.59.0-150300.21.20.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rust1.58","fixed_in":["1.58.0-150300.7.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rust1.59","fixed_in":["1.59.0-150300.7.4.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust1.56","fixed_in":["1.56.1-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust1.57","fixed_in":["1.57.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust1.58","fixed_in":["1.58.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cargo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-analysis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-std-static-wasm32-wasi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-1.module_el8.6.0+2748+176088b3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-analysis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static-wasm32-wasi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+14021+586eff1a"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+826+60f85975"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.1-1.module+el8.6.0+826+60f85975"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.1-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.55","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.57","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0-150300.7.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-3.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-150300.21.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.58","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.0-150300.7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"rust1.59","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-150300.7.4.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1+dfsg0-1~exp1ubuntu2~14.04.7","1.17.0+dfsg2-8~ubuntu0.14.04.3","1.21.0+dfsg1+llvm-0ubuntu3~14.04.5","1.22.1+dfsg1+llvm-0ubuntu2~14.04.2","1.24.1+dfsg1+llvm-0ubuntu1~14.04.1","1.25.0+dfsg1+llvm-0ubuntu1~14.04.1","1.28.0+dfsg1+llvm-0ubuntu1~14.04.1","1.30.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0+dfsg1-1","1.15.1+dfsg0-1~exp1ubuntu2~16.04.3","1.17.0+dfsg2-8~ubuntu0.16.04.2","1.21.0+dfsg1+llvm-0ubuntu3~16.04.1","1.22.1+dfsg1+llvm-0ubuntu2~16.04.2","1.24.1+dfsg1+llvm-0ubuntu1~16.04.1","1.25.0+dfsg1+llvm-0ubuntu1~16.04.1","1.28.0+dfsg1+llvm-0ubuntu1~16.04.1","1.30.0+dfsg1+llvm-2ubuntu1~16.04.1","1.31.0+dfsg1+llvm-2ubuntu1~16.04.1","1.32.0+dfsg1+llvm-1ubuntu1~16.04.1","1.34.1+dfsg2+llvm-0ubuntu1~16.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1","1.36.0+dfsg1+llvm-2ubuntu1~16.04.1","1.37.0+dfsg1+llvm-1ubuntu1~16.04.1","1.39.0+dfsg1+llvm-3ubuntu1~16.04.1","1.41.0+dfsg1+llvm-0ubuntu1~16.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2"}]}],"versions":["1.37.0+dfsg1+llvm-1ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu2","1.39.0+dfsg1+llvm-3ubuntu1","1.40.0+dfsg1+llvm-5ubuntu1","1.41.0+dfsg1+llvm-0ubuntu1","1.41.0+dfsg1+llvm-0ubuntu2","1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1","1.47.0+dfsg1+llvm-1ubuntu1~20.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2","1.53.0+dfsg1+llvm-4ubuntu1~20.04.1","1.57.0+dfsg1+llvm-0ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"libredwg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libredwg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust1.56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.1-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libredwg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust1.56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.1-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust1.55","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-150300.7.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust1.57","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0-150300.7.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0-22.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-150300.21.20.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust1.58","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.0-150300.7.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rust1.59","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-150300.7.4.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.56","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.1-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.57","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust1.58","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.0-2.1"}]}]}],"products":[{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"tvos"},{"vendor":"apple","product":"watchos"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"rust-lang","product":"rust"}],"references":[{"url":"https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2","tags":["x_transferred","Exploit","Mitigation","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/rust-lang/rust/pull/93110","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html","tags":["x_transferred","Exploit","Mitigation","Vendor Advisory","article","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://support.apple.com/kb/HT213183","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT213182","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT213186","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT213193","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://security.gentoo.org/glsa/202210-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1894.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-21658","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21658","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-21658","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21658.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21658","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0044.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29912","tags":["report"]},{"url":"https://blog.rust-lang.org/2021/12/02/Rust-1.57.0.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1894","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041504","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1894.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21658","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1894","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194767","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21658","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220171-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220175-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220200-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220491-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220843-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21658","tags":["report"]},{"url":"https://groups.google.com/g/rustlang-security-announcements/c/R1fZFDhnJVQ?pli=1","tags":["report"]},{"url":"https://rustsec.org/advisories/CVE-2022-21658.html","tags":["report"]},{"url":"https://github.com/rust-lang/wg-security-response/blob/master/patches/CVE-2022-21658/0002-Fix-CVE-2022-21658-for-UNIX-like.patch","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JWT2GLRS2EG6EW7X57X2RMJHMFK6GEWU/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CXNFO6HH5VY6DMGZN52EB2OJNJXKBC5H/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7LMNDFMX4WXDPLRBNT2EQKB2QXZZVISA/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EL7GUT2ZSPRSFN52THPCRG67APLUTSL7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZODX3XK3LNWUDIGOVAOXXYOTCRZZ4CMJ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21658","title":"Race condition in std::fs::remove_dir_all in rustlang","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T00:00:00Z","modified":"2025-04-22T18:32:53.619Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-363","CWE-367"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-26876","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T00:00:00Z","modified":"2025-04-22T18:32:53Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"nvd":[{"id":"CVE-2022-21658","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T18:15:07.703Z","modified":"2026-06-17T04:26:42.123Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:L/AC:M/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-363","CWE-367"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"AZL-8337","title":"CVE-2022-21658 affecting package rust for versions less than 1.59.0-1","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T18:15:07Z","modified":"2026-04-21T04:34:48.714622Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"BELL-CVE-2022-21658","title":"CVE-2022-21658 does not affect BellSoft software","status":"withdrawn","published":"2022-01-20T18:15:00Z","modified":"2026-01-26T09:49:19.084349Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-21658","title":"Race condition in std::fs::remove_dir_all in rustlang","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T00:00:00Z","modified":"2026-10-28T02:30:58.996551966Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-363","CWE-367"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21658","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T18:15:07.703Z","modified":"2026-11-03T08:01:01.709857959Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"RHSA-2022:1894","title":"Red Hat Security Advisory: rust-toolset:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-09-14T01:28:20Z","modified":"2026-08-07T10:05:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1894","title":"Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update","description":"Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. \n\nThe following packages have been upgraded to a later upstream version: rust (1.58.0). (BZ#2002883)\n\nSecurity Fix(es):\n\n* rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed (CVE-2022-21658)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:06:44Z","modified":"2026-02-05T00:15:12.291181Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-21658","description":"Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.","status":"published","published":"2022-01-20T11:00:00Z","modified":"2026-04-22T13:17:59.446338Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"ALSA-2022:1894","title":"Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update","description":"Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. \n\nThe following packages have been upgraded to a later upstream version: rust (1.58.0). (BZ#2002883)\n\nSecurity Fix(es):\n\n* rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed (CVE-2022-21658)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:06:44Z","modified":"2026-10-29T11:01:17.039462139Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2022-0044","title":"Updated rust packages fix security vulnerability","description":"This update provides Rust 1.57.0 as a feature and bugfix update. See the\nrelease notes for details.\n\nThe 'std::fs::remove_dir_all' standard library function was vulnerable a race\ncondition enabling symlink following (CWE-363). An attacker could use this\nsecurity issue to trick a privileged program into deleting files and\ndirectories the attacker couldn't otherwise access or delete (CVE-2022-21658).\nThis vulnerability was fixed by patching Rust 1.57.0.\n","status":"published","published":"2022-02-02T21:29:30Z","modified":"2026-04-16T04:43:53.435732478Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0149-1","title":"Security update for rust1.56","description":"This update for rust1.56 fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-21T08:04:54Z","modified":"2026-02-04T03:30:20.874528Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0171-1","title":"Security update for rust1.55","description":"This update for rust1.55 fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-25T12:56:24Z","modified":"2026-02-04T02:17:05.111641Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0175-1","title":"Security update for rust1.57","description":"This update for rust1.57 fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-25T13:10:43Z","modified":"2026-02-04T04:20:40.172869Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0491-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-02-18T09:29:34Z","modified":"2026-02-04T02:59:04.827971Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:0843-1","title":"Security update for rust, rust1.58, rust1.59","description":"This update for rust, rust1.58, rust1.59 fixes the following issues:\n\nThis update provides both rust1.58 and rust1.59.\n\nChanges in rust1.58:\n\n- Add recommends for GCC for installs to be able to link.\n- Add suggests for lld/clang which are faster than gcc for linking to\n  allow users choice on what they use.\n- CVE-2022-21658: Resolve race condition in std::fs::remove_dir_all (bsc#1194767)\n\nVersion 1.58.0 (2022-01-13)\n==========================\n\nLanguage\n--------\n- [Format strings can now capture arguments simply by writing `{ident}` in the string.][90473] This works in all macros accepting format strings. Support for this in `panic!` (`panic!('{ident}')`) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect.\n- [`*const T` pointers can now be dereferenced in const contexts.][89551]\n- [The rules for when a generic struct implements `Unsize` have been relaxed.][90417]\nCompiler\n--------\n- [Add LLVM CFI support to the Rust compiler][89652]\n- [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the `strip` option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo.\n- [Add support for LLVM coverage mapping format versions 5 and 6][91207]\n- [Emit LLVM optimization remarks when enabled with `-Cremark`][90833]\n- [Update the minimum external LLVM to 12][90175]\n- [Add `x86_64-unknown-none` at Tier 3*][89062]\n- [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries.\n- [Don't abort compilation after giving a lint error][87337]\n- [Error messages point at the source of trait bound obligations in more places][89580]\n\\* Refer to Rust's [platform support page][platform-support-doc] for more\n   information on Rust's tiered platform support.\n\nLibraries\n---------\n\n- [All remaining functions in the standard library have `#[must_use]` annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value.\n- [Paths are automatically canonicalized on Windows for operations that support it][89174]\n- [Re-enable debug checks for `copy` and `copy_nonoverlapping`][90041]\n- [Implement `RefUnwindSafe` for `Rc\u003cT\u003e`][87467]\n- [Make RSplit\u003cT, P\u003e: Clone not require T: Clone][90117]\n- [Implement `Termination` for `Result\u003cInfallible, E\u003e`][88601]. This allows writing `fn main() -\u003e Result\u003cInfallible, ErrorType\u003e`, for a program whose successful exits never involve returning from `main` (for instance, a program that calls `exit`, or that uses `exec` to run another program).\n\nStabilized APIs\n---------------\n\n- [`Metadata::is_symlink`]\n- [`Path::is_symlink`]\n- [`{integer}::saturating_div`]\n- [`Option::unwrap_unchecked`]\n- [`Result::unwrap_unchecked`]\n- [`Result::unwrap_err_unchecked`]\n- [`NonZero{unsigned}::is_power_of_two`]\n- [`File::options`]\nThese APIs are now usable in const contexts:\n- [`Duration::new`]\n- [`Duration::checked_add`]\n- [`Duration::saturating_add`]\n- [`Duration::checked_sub`]\n- [`Duration::saturating_sub`]\n- [`Duration::checked_mul`]\n- [`Duration::saturating_mul`]\n- [`Duration::checked_div`]\n- [`MaybeUninit::as_ptr`]\n- [`MaybeUninit::as_mut_ptr`]\n- [`MaybeUninit::assume_init`]\n- [`MaybeUninit::assume_init_ref`]\n\nCargo\n-----\n\n- [Add --message-format for install command][cargo/10107]\n- [Warn when alias shadows external subcommand][cargo/10082]\n\nRustdoc\n-------\n\n- [Show all Deref implementations recursively in rustdoc][90183]\n- [Use computed visibility in rustdoc][88447]\n\nCompatibility Notes\n-------------------\n\n- [Try all stable method candidates first before trying unstable ones][90329]. This change ensures that adding new nightly-only methods to the Rust standard library will not break code invoking methods of the same name from traits outside the standard library.\n- Windows: [`std::process::Command` will no longer search the current directory for executables.][87704]\n- [All proc-macro backward-compatibility lints are now deny-by-default.][88041]\n- [proc_macro: Append .0 to unsuffixed float if it would otherwise become int token][90297]\n- [Refactor weak symbols in std::sys::unix][90846]. This optimizes accesses to glibc functions, by avoiding the use of dlopen. This does not increase the [minimum expected version of glibc](https://doc.rust-lang.org/nightly/rustc/platform-support.html). However, software distributions that use symbol versions to detect library dependencies, and which take weak symbols into account in that analysis, may detect rust binaries as requiring newer versions of glibc.\n- [rustdoc now rejects some unexpected semicolons in doctests][91026]\n\nVersion 1.59.0 (2022-02-24)\n==========================\n\nLanguage\n--------\n\n- [Stabilize default arguments for const generics][90207]\n- [Stabilize destructuring assignment][90521]\n- [Relax private in public lint on generic bounds and where clauses of trait impls][90586]\n- [Stabilize asm! and global_asm! for x86, x86_64, ARM, Aarch64, and RISC-V][91728]\n\nCompiler\n--------\n\n- [Stabilize new symbol mangling format, leaving it opt-in (-Csymbol-mangling-version=v0)][90128]\n- [Emit LLVM optimization remarks when enabled with `-Cremark`][90833]\n- [Fix sparc64 ABI for aggregates with floating point members][91003]\n- [Warn when a `#[test]`-like built-in attribute macro is present multiple times.][91172]\n- [Add support for riscv64gc-unknown-freebsd][91284]\n- [Stabilize `-Z emit-future-incompat` as `--json future-incompat`][91535]\n\nLibraries\n---------\n\n- [Remove unnecessary bounds for some Hash{Map,Set} methods][91593]\n\nStabilized APIs\n---------------\n\n- [`std::thread::available_parallelism`][available_parallelism]\n- [`Result::copied`][result-copied]\n- [`Result::cloned`][result-cloned]\n- [`arch::asm!`][asm]\n- [`arch::global_asm!`][global_asm]\n- [`ops::ControlFlow::is_break`][is_break]\n- [`ops::ControlFlow::is_continue`][is_continue]\n- [`TryFrom\u003cchar\u003e for u8`][try_from_char_u8]\n- [`char::TryFromCharError`][try_from_char_err]\n  implementing `Clone`, `Debug`, `Display`, `PartialEq`, `Copy`, `Eq`, `Error`\n- [`iter::zip`][zip]\n- [`NonZeroU8::is_power_of_two`][is_power_of_two8]\n- [`NonZeroU16::is_power_of_two`][is_power_of_two16]\n- [`NonZeroU32::is_power_of_two`][is_power_of_two32]\n- [`NonZeroU64::is_power_of_two`][is_power_of_two64]\n- [`NonZeroU128::is_power_of_two`][is_power_of_two128]\n- [`DoubleEndedIterator for ToLowercase`][lowercase]\n- [`DoubleEndedIterator for ToUppercase`][uppercase]\n- [`TryFrom\u003c\u0026mut [T]\u003e for [T; N]`][tryfrom_ref_arr]\n- [`UnwindSafe for Once`][unwindsafe_once]\n- [`RefUnwindSafe for Once`][refunwindsafe_once]\n- [armv8 neon intrinsics for aarch64][stdarch/1266]\nConst-stable:\n- [`mem::MaybeUninit::as_ptr`][muninit_ptr]\n- [`mem::MaybeUninit::assume_init`][muninit_init]\n- [`mem::MaybeUninit::assume_init_ref`][muninit_init_ref]\n- [`ffi::CStr::from_bytes_with_nul_unchecked`][cstr_from_bytes]\n\nCargo\n-----\n\n- [Stabilize the `strip` profile option][cargo/10088]\n- [Stabilize future-incompat-report][cargo/10165]\n- [Support abbreviating `--release` as `-r`][cargo/10133]\n- [Support `term.quiet` configuration][cargo/10152]\n- [Remove `--host` from cargo {publish,search,login}][cargo/10145]\n\nCompatibility Notes\n-------------------\n\n- [Refactor weak symbols in std::sys::unix][90846]\n  This may add new, versioned, symbols when building with a newer glibc, as the\n  standard library uses weak linkage rather than dynamically attempting to load\n  certain symbols at runtime.\n- [Deprecate crate_type and crate_name nested inside `#![cfg_attr]`][83744]\n  This adds a future compatibility lint to supporting the use of cfg_attr\n  wrapping either crate_type or crate_name specification within Rust files;\n  it is recommended that users migrate to setting the equivalent command line\n  flags.\n- [Remove effect of `#[no_link]` attribute on name resolution][92034]\n  This may expose new names, leading to conflicts with preexisting names in a\n  given namespace and a compilation failure.\n- [Cargo will document libraries before binaries.][cargo/10172]\n- [Respect doc=false in dependencies, not just the root crate][cargo/10201]\n- [Weaken guarantee around advancing underlying iterators in zip][83791]\n- [Make split_inclusive() on an empty slice yield an empty output][89825]\n- [Update std::env::temp_dir to use GetTempPath2 on Windows when available.][89999]\n\nChanges in rust wrapper package:\n\n- Update to version 1.59.0 - for details see the rust1.59 package\n\n- Update package description to help users choose what tooling\n  to install.\n\n- Provide rust+cargo by cargo: all cargo\u003cn\u003e package provide this\n  symbol too. Having the meta package provide it allows OBS to have\n  a generic prefernece on the meta package for all packages 'just'\n  requiring rust+cargo.\n\n- Update to version 1.58.0\n","status":"published","published":"2022-03-15T10:33:50Z","modified":"2026-02-04T02:54:17.94146Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11767-1","title":"cargo1.56-1.56.1-4.1 on GA media","description":"These are all security issues fixed in the cargo1.56-1.56.1-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:07.994512Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11768-1","title":"cargo1.57-1.57.0-3.1 on GA media","description":"These are all security issues fixed in the cargo1.57-1.57.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:43.513327Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11769-1","title":"cargo1.58-1.58.0-2.1 on GA media","description":"These are all security issues fixed in the cargo1.58-1.58.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:27.049304Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2022:0149-1","title":"Security update for rust1.56","description":"This update for rust1.56 fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-21T08:04:54Z","modified":"2026-02-04T02:40:31.664805Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0171-1","title":"Security update for rust1.55","description":"This update for rust1.55 fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-25T12:56:23Z","modified":"2025-05-02T04:10:56.206221Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0175-1","title":"Security update for rust1.57","description":"This update for rust1.57 fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-25T13:10:42Z","modified":"2026-02-04T04:28:59.618317Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0200-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-01-26T10:34:40Z","modified":"2026-02-04T03:47:26.313798Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0491-1","title":"Security update for rust","description":"This update for rust fixes the following issues:\n\n- CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).\n","status":"published","published":"2022-02-18T09:30:32Z","modified":"2026-02-04T02:47:08.710384Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0843-1","title":"Security update for rust, rust1.58, rust1.59","description":"This update for rust, rust1.58, rust1.59 fixes the following issues:\n\nThis update provides both rust1.58 and rust1.59.\n\nChanges in rust1.58:\n\n- Add recommends for GCC for installs to be able to link.\n- Add suggests for lld/clang which are faster than gcc for linking to\n  allow users choice on what they use.\n- CVE-2022-21658: Resolve race condition in std::fs::remove_dir_all (bsc#1194767)\n\nVersion 1.58.0 (2022-01-13)\n==========================\n\nLanguage\n--------\n- [Format strings can now capture arguments simply by writing `{ident}` in the string.][90473] This works in all macros accepting format strings. Support for this in `panic!` (`panic!('{ident}')`) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect.\n- [`*const T` pointers can now be dereferenced in const contexts.][89551]\n- [The rules for when a generic struct implements `Unsize` have been relaxed.][90417]\nCompiler\n--------\n- [Add LLVM CFI support to the Rust compiler][89652]\n- [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the `strip` option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo.\n- [Add support for LLVM coverage mapping format versions 5 and 6][91207]\n- [Emit LLVM optimization remarks when enabled with `-Cremark`][90833]\n- [Update the minimum external LLVM to 12][90175]\n- [Add `x86_64-unknown-none` at Tier 3*][89062]\n- [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries.\n- [Don't abort compilation after giving a lint error][87337]\n- [Error messages point at the source of trait bound obligations in more places][89580]\n\\* Refer to Rust's [platform support page][platform-support-doc] for more\n   information on Rust's tiered platform support.\n\nLibraries\n---------\n\n- [All remaining functions in the standard library have `#[must_use]` annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value.\n- [Paths are automatically canonicalized on Windows for operations that support it][89174]\n- [Re-enable debug checks for `copy` and `copy_nonoverlapping`][90041]\n- [Implement `RefUnwindSafe` for `Rc\u003cT\u003e`][87467]\n- [Make RSplit\u003cT, P\u003e: Clone not require T: Clone][90117]\n- [Implement `Termination` for `Result\u003cInfallible, E\u003e`][88601]. This allows writing `fn main() -\u003e Result\u003cInfallible, ErrorType\u003e`, for a program whose successful exits never involve returning from `main` (for instance, a program that calls `exit`, or that uses `exec` to run another program).\n\nStabilized APIs\n---------------\n\n- [`Metadata::is_symlink`]\n- [`Path::is_symlink`]\n- [`{integer}::saturating_div`]\n- [`Option::unwrap_unchecked`]\n- [`Result::unwrap_unchecked`]\n- [`Result::unwrap_err_unchecked`]\n- [`NonZero{unsigned}::is_power_of_two`]\n- [`File::options`]\nThese APIs are now usable in const contexts:\n- [`Duration::new`]\n- [`Duration::checked_add`]\n- [`Duration::saturating_add`]\n- [`Duration::checked_sub`]\n- [`Duration::saturating_sub`]\n- [`Duration::checked_mul`]\n- [`Duration::saturating_mul`]\n- [`Duration::checked_div`]\n- [`MaybeUninit::as_ptr`]\n- [`MaybeUninit::as_mut_ptr`]\n- [`MaybeUninit::assume_init`]\n- [`MaybeUninit::assume_init_ref`]\n\nCargo\n-----\n\n- [Add --message-format for install command][cargo/10107]\n- [Warn when alias shadows external subcommand][cargo/10082]\n\nRustdoc\n-------\n\n- [Show all Deref implementations recursively in rustdoc][90183]\n- [Use computed visibility in rustdoc][88447]\n\nCompatibility Notes\n-------------------\n\n- [Try all stable method candidates first before trying unstable ones][90329]. This change ensures that adding new nightly-only methods to the Rust standard library will not break code invoking methods of the same name from traits outside the standard library.\n- Windows: [`std::process::Command` will no longer search the current directory for executables.][87704]\n- [All proc-macro backward-compatibility lints are now deny-by-default.][88041]\n- [proc_macro: Append .0 to unsuffixed float if it would otherwise become int token][90297]\n- [Refactor weak symbols in std::sys::unix][90846]. This optimizes accesses to glibc functions, by avoiding the use of dlopen. This does not increase the [minimum expected version of glibc](https://doc.rust-lang.org/nightly/rustc/platform-support.html). However, software distributions that use symbol versions to detect library dependencies, and which take weak symbols into account in that analysis, may detect rust binaries as requiring newer versions of glibc.\n- [rustdoc now rejects some unexpected semicolons in doctests][91026]\n\nVersion 1.59.0 (2022-02-24)\n==========================\n\nLanguage\n--------\n\n- [Stabilize default arguments for const generics][90207]\n- [Stabilize destructuring assignment][90521]\n- [Relax private in public lint on generic bounds and where clauses of trait impls][90586]\n- [Stabilize asm! and global_asm! for x86, x86_64, ARM, Aarch64, and RISC-V][91728]\n\nCompiler\n--------\n\n- [Stabilize new symbol mangling format, leaving it opt-in (-Csymbol-mangling-version=v0)][90128]\n- [Emit LLVM optimization remarks when enabled with `-Cremark`][90833]\n- [Fix sparc64 ABI for aggregates with floating point members][91003]\n- [Warn when a `#[test]`-like built-in attribute macro is present multiple times.][91172]\n- [Add support for riscv64gc-unknown-freebsd][91284]\n- [Stabilize `-Z emit-future-incompat` as `--json future-incompat`][91535]\n\nLibraries\n---------\n\n- [Remove unnecessary bounds for some Hash{Map,Set} methods][91593]\n\nStabilized APIs\n---------------\n\n- [`std::thread::available_parallelism`][available_parallelism]\n- [`Result::copied`][result-copied]\n- [`Result::cloned`][result-cloned]\n- [`arch::asm!`][asm]\n- [`arch::global_asm!`][global_asm]\n- [`ops::ControlFlow::is_break`][is_break]\n- [`ops::ControlFlow::is_continue`][is_continue]\n- [`TryFrom\u003cchar\u003e for u8`][try_from_char_u8]\n- [`char::TryFromCharError`][try_from_char_err]\n  implementing `Clone`, `Debug`, `Display`, `PartialEq`, `Copy`, `Eq`, `Error`\n- [`iter::zip`][zip]\n- [`NonZeroU8::is_power_of_two`][is_power_of_two8]\n- [`NonZeroU16::is_power_of_two`][is_power_of_two16]\n- [`NonZeroU32::is_power_of_two`][is_power_of_two32]\n- [`NonZeroU64::is_power_of_two`][is_power_of_two64]\n- [`NonZeroU128::is_power_of_two`][is_power_of_two128]\n- [`DoubleEndedIterator for ToLowercase`][lowercase]\n- [`DoubleEndedIterator for ToUppercase`][uppercase]\n- [`TryFrom\u003c\u0026mut [T]\u003e for [T; N]`][tryfrom_ref_arr]\n- [`UnwindSafe for Once`][unwindsafe_once]\n- [`RefUnwindSafe for Once`][refunwindsafe_once]\n- [armv8 neon intrinsics for aarch64][stdarch/1266]\nConst-stable:\n- [`mem::MaybeUninit::as_ptr`][muninit_ptr]\n- [`mem::MaybeUninit::assume_init`][muninit_init]\n- [`mem::MaybeUninit::assume_init_ref`][muninit_init_ref]\n- [`ffi::CStr::from_bytes_with_nul_unchecked`][cstr_from_bytes]\n\nCargo\n-----\n\n- [Stabilize the `strip` profile option][cargo/10088]\n- [Stabilize future-incompat-report][cargo/10165]\n- [Support abbreviating `--release` as `-r`][cargo/10133]\n- [Support `term.quiet` configuration][cargo/10152]\n- [Remove `--host` from cargo {publish,search,login}][cargo/10145]\n\nCompatibility Notes\n-------------------\n\n- [Refactor weak symbols in std::sys::unix][90846]\n  This may add new, versioned, symbols when building with a newer glibc, as the\n  standard library uses weak linkage rather than dynamically attempting to load\n  certain symbols at runtime.\n- [Deprecate crate_type and crate_name nested inside `#![cfg_attr]`][83744]\n  This adds a future compatibility lint to supporting the use of cfg_attr\n  wrapping either crate_type or crate_name specification within Rust files;\n  it is recommended that users migrate to setting the equivalent command line\n  flags.\n- [Remove effect of `#[no_link]` attribute on name resolution][92034]\n  This may expose new names, leading to conflicts with preexisting names in a\n  given namespace and a compilation failure.\n- [Cargo will document libraries before binaries.][cargo/10172]\n- [Respect doc=false in dependencies, not just the root crate][cargo/10201]\n- [Weaken guarantee around advancing underlying iterators in zip][83791]\n- [Make split_inclusive() on an empty slice yield an empty output][89825]\n- [Update std::env::temp_dir to use GetTempPath2 on Windows when available.][89999]\n\nChanges in rust wrapper package:\n\n- Update to version 1.59.0 - for details see the rust1.59 package\n\n- Update package description to help users choose what tooling\n  to install.\n\n- Provide rust+cargo by cargo: all cargo\u003cn\u003e package provide this\n  symbol too. Having the meta package provide it allows OBS to have\n  a generic prefernece on the meta package for all packages 'just'\n  requiring rust+cargo.\n\n- Update to version 1.58.0\n","status":"published","published":"2022-03-15T10:33:49Z","modified":"2026-02-04T02:52:03.248451Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}