Withdraw RUSTSEC-2020-0159: unsound localtime_r call in chrono
#1241
Conversation
Per #1190, it would be good to move to a policy where we don't file advisories against crates which perform unsynchronized reads from the process environment, and instead focus only on crates which modify the process environment in an unsynchronized manner.
tarcieri
force-pushed
the
yank-RUSTSEC-2020-0159
branch
from
bb2516e to
d3cf0ba
Compare
| @@ -7,6 +7,8 @@ url = "https://github.com/chronotope/chrono/issues/499" | |||
| categories = ["code-execution", "memory-corruption"] | |||
| keywords = ["segfault"] | |||
| related = ["CVE-2020-26235", "RUSTSEC-2020-0071"] | |||
| withdrawn = "2022-05-12" # see rustsec/advisory-db#1190 | |||
There was a problem hiding this comment.
Maybe we should move the rationale for yanking to the Markdown part, so that it shows up in exported data as well (OSV, GHSA etc)?
There was a problem hiding this comment.
That'd be a good idea, but it seems this feature is still halfway migrated from a boolean yanked = true flag to withdrawn = with the date.
So we'd need to get support into the next rustsec crate release, wait for everyone to upgrade, then start using it after the next release.
Maybe open a tracking ticket for this on https://github.com/rustsec/rustsec ?
There was a problem hiding this comment.
I meant the comment: # see rustsec/advisory-db#1190
Also, I thought I've migrated the rustsec crate to dates, and left the yanked = true in the advisories for backwards compatibility... if that's not the case, I should add that to my TODO.
There was a problem hiding this comment.
Yeah, I understand what you're saying. I'm just saying this field is already in flux, and we'd need to add another forward-compatible change to the code first before we could modify the database.
tarcieri
changed the title
localtime_r call in chronolocaltime_r call in chrono
Per #1190, it would be good to move to a policy where we don't file advisories against crates which perform unsynchronized reads from the process environment, and instead focus only on crates which modify the process environment in an unsynchronized manner.