sfackler / rust-native-tls

Apache License 2.0
468 stars 197 forks source link

RUSTSEC vulnerability in `tempfile` - need to take updated version #258

Closed tdmb closed 1 year ago

tdmb commented 1 year ago

From cargo audit:

Crate:     remove_dir_all
Version:   0.5.3
Title:     Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)
Date:      2023-02-24
ID:        RUSTSEC-2023-0018
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0018
Solution:  Upgrade to >=0.8.0
Dependency tree:
remove_dir_all 0.5.3
└── tempfile 3.3.0
    ├── native-tls 0.2.1`

Solution is to upgrade to tempfile 3.4.0. Since that contains some breaking changes, I don't know whether it's safe to patch that version of tempfile in my Rust code that uses rust-native-tls.

sfackler commented 1 year ago

Run cargo update.