{"id":"MGASA-2022-0044","summary":"Updated rust packages fix security vulnerability","details":"This update provides Rust 1.57.0 as a feature and bugfix update. See the\nrelease notes for details.\n\nThe 'std::fs::remove_dir_all' standard library function was vulnerable a race\ncondition enabling symlink following (CWE-363). An attacker could use this\nsecurity issue to trick a privileged program into deleting files and\ndirectories the attacker couldn't otherwise access or delete (CVE-2022-21658).\nThis vulnerability was fixed by patching Rust 1.57.0.\n","modified":"2026-02-02T11:45:54.510543Z","published":"2022-02-02T21:29:30Z","related":["CVE-2022-21658"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2022-0044.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=29912"},{"type":"REPORT","url":"https://blog.rust-lang.org/2021/12/02/Rust-1.57.0.html"},{"type":"REPORT","url":"https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html"}],"affected":[{"package":{"name":"rust","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/rust?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0-1.1.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2022-0044.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}