Skip to content
This repository has been archived by the owner on Nov 1, 2023. It is now read-only.

WS-2023-0045 #2930

Closed
chkeita opened this issue Mar 20, 2023 · 0 comments · Fixed by #2931 or #2957
Closed

WS-2023-0045 #2930

chkeita opened this issue Mar 20, 2023 · 0 comments · Fixed by #2931 or #2957
Assignees
@chkeita
Labels
bug Something isn't working

Comments

@chkeita
Copy link
Contributor

chkeita commented Mar 20, 2023 •
edited by azure-boards bot
Loading

The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.

AB#45317
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@chkeita chkeita

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix WS-2023-0045 chkeita/onefuzz
Fix WS-2023-0045 and CVE-2023-0286 chkeita/onefuzz
1 participant
@chkeita