{"id":"GHSA-f2wx-xjfw-xjv6","aliases":[],"status":"published","title":"topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all","description":"### Summary\nhttps://github.com/advisories/GHSA-mc8h-8q98-g5hr\nhttps://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead\n\n`tempfile` v0.4.26 ships with affected `remove_dir_all` v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean `cargo audit`\n\nUpdating `tempfile` is warranted","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2023-07-17T18:21:58Z","modified":"2023-07-24T20:02:33Z","fixes":[{"ecosystem":"crates.io","package":"topgrade","fixed_in":["12.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"topgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"12.0.0"},{"fixed":"12.0.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"topgrade","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"12.0.1"}]}]}],"references":[{"url":"https://github.com/topgrade-rs/topgrade/security/advisories/GHSA-f2wx-xjfw-xjv6","tags":["web"]},{"url":"https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mc8h-8q98-g5hr","tags":["advisory"]},{"url":"https://github.com/topgrade-rs/topgrade/releases/tag/v12.0.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f2wx-xjfw-xjv6"},{"url":"https://github.com/topgrade-rs/topgrade","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f2wx-xjfw-xjv6","title":"topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all","description":"### Summary\nhttps://github.com/advisories/GHSA-mc8h-8q98-g5hr\nhttps://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead\n\n`tempfile` v0.4.26 ships with affected `remove_dir_all` v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean `cargo audit`\n\nUpdating `tempfile` is warranted","status":"published","published":"2023-07-17T18:21:58Z","modified":"2023-07-24T20:02:33Z","cwes":["CWE-367"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"osv":[{"id":"GHSA-f2wx-xjfw-xjv6","title":"topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all","description":"### Summary\nhttps://github.com/advisories/GHSA-mc8h-8q98-g5hr\nhttps://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead\n\n`tempfile` v0.4.26 ships with affected `remove_dir_all` v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean `cargo audit`\n\nUpdating `tempfile` is warranted","status":"published","published":"2023-07-17T18:21:58Z","modified":"2023-07-17T18:21:58Z","cwes":["CWE-367"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}