[GHSA-cqpr-pcm7-m3jc] Potential segfault in localtime_r invocations

[LunaBorowska]

Updates

• Affected products
• Description
• References

[LunaBorowska]

By the way, I would like to note that RustSec withdrawn this vulnerability (https://rustsec.org/advisories/RUSTSEC-2020-0159.html). Assigning CNA for this vulnerability is GitHub, so figured I would tell you in case you want to want to dispute this vulnerability or something. The reason being that RustSec doesn't consider using getenv to be a vulnerability anymore, but rather using std::env::set_env with multiple threads (see rustsec/advisory-db#1190).

[LunaBorowska]

Oops, I got confused by RUSTSEC. CVE-2020-26235 is a vulnerability for time crate. That said, the vulnerability was withdrawn, see https://rustsec.org/advisories/RUSTSEC-2020-0159.html.