RUSTSEC-2020-0159: Potential segfault in localtime_r invocations
#245
Comments
clintfred
added a commit
that referenced
this issue
Nov 19, 2021
…`time::OffsetDateTime`. This change should not have any semantic meaning and is being done to address RUSTSEC-2020-0071 (see #244) and RUSTSEC-20200159 (see #245). This is a breaking API change because some result types include create/updated timestamps. Consumers of the library will need to add a direct dependency on `time`. Note that `chrono` already uses `time` internally, so this change should not bloat transitive dependencies. For those needing serialization support of `OffsetDateTime` timestamps, the `time` crate offers this support with the `serde` feature flag. One small point of friction here is rfc3339 support. `time` has this support on [a branch](time-rs/time#387) that is blocked on a rust feature hitting stable, so I copied in a few lines of code from that branch to support deserializing rfc3339 timestamps.
clintfred
added a commit
that referenced
this issue
Nov 23, 2021
…`time::OffsetDateTime` (#249) * Removes `chrono` and usages of `DateTime<Utc>` and replaces them with`time::OffsetDateTime`. This change should not have any semantic meaning and is being done to address RUSTSEC-2020-0071 (see #244) and RUSTSEC-20200159 (see #245). This is a breaking API change because some result types include create/updated timestamps. Consumers of the library will need to add a direct dependency on `time`. Note that `chrono` already uses `time` internally, so this change should not bloat transitive dependencies. For those needing serialization support of `OffsetDateTime` timestamps, the `time` crate offers this support with the `serde` feature flag. One small point of friction here is rfc3339 support. `time` has this support on [a branch](time-rs/time#387) that is blocked on a rust feature hitting stable, so I copied in a few lines of code from that branch to support deserializing rfc3339 timestamps. * depend on our fork of jsonwebtoken * cargo fmt * lock to specific rev on jsonwebtoken fork * self review changes * Update to new jsonwebtoken Co-authored-by: Colt Frederickson <[email protected]>
|
Closed by #249 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
chrono0.4.19Impact
Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
Workarounds
No workarounds are known.
References
See advisory page for additional details.
The text was updated successfully, but these errors were encountered: