Skip to content

Withdraw RUSTSEC-2020-0159: unsound localtime_r call in chrono #1241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 12, 2022
Merged

Withdraw RUSTSEC-2020-0159: unsound localtime_r call in chrono #1241

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions crates/chrono/RUSTSEC-2020-0159.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ url = "https://github.com/chronotope/chrono/issues/499"
categories = ["code-execution", "memory-corruption"]
keywords = ["segfault"]
related = ["CVE-2020-26235", "RUSTSEC-2020-0071"]
withdrawn = "2022-05-12" # see rustsec/advisory-db#1190
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we should move the rationale for yanking to the Markdown part, so that it shows up in exported data as well (OSV, GHSA etc)?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That'd be a good idea, but it seems this feature is still halfway migrated from a boolean yanked = true flag to withdrawn = with the date.

So we'd need to get support into the next rustsec crate release, wait for everyone to upgrade, then start using it after the next release.

Maybe open a tracking ticket for this on https://github.com/rustsec/rustsec ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant the comment: # see rustsec/advisory-db#1190

Also, I thought I've migrated the rustsec crate to dates, and left the yanked = true in the advisories for backwards compatibility... if that's not the case, I should add that to my TODO.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I understand what you're saying. I'm just saying this field is already in flux, and we'd need to add another forward-compatible change to the code first before we could modify the database.

yanked = true

[versions]
patched = []
Expand Down