Summary
Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.
The following packages have been upgraded to a later upstream version: rust (1.58.0). (BZ#2002883)
Security Fix(es):
* rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed (CVE-2022-21658)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | cargo | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | cargo-doc | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | clippy | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rls | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-analysis | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-debugger-common | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-doc | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-gdb | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-lldb | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-src | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-std-static | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-std-static-wasm32-unknown-unknown | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-std-static-wasm32-wasi | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rust-toolset | 1.58.1-1.module_el8.6.0+2748+176088b3 |
| AlmaLinux · 8 | rustfmt | 1.58.1-1.module_el8.6.0+2748+176088b3 |
Vulnerabilities 1
-
High 7.3CVE-2022-21658 Public exploit
Race condition in std::fs::remove_dir_all in rustlang
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condi…
References
-
report
https://vulners.com/cve/CVE-2022-21658