CVE-2020-26235 advisory for time 0.1 dependency #602

acim · 2021-10-11T17:05:58Z

Please update time dependency.

Inverse Dependency graph
time 0.1.44 (registry+https://github.com/rust-lang/crates.io-index)
└── chrono 0.4.19 (registry+https://github.com/rust-lang/crates.io-index)

timvisee · 2021-10-11T17:17:36Z

~~Yes!~~

~~I've prepared a PR for it some time ago, but it hasn't been merged yet: #578~~

CryZe · 2021-10-11T17:31:14Z

Everything below 0.2.7 is unaffected:
https://github.com/rustsec/advisory-db/blob/main/crates/time/RUSTSEC-2020-0071.md?plain=1#L36

However chrono does seem somewhat unmaintained, so maybe it makes sense to just switch to time 0.3 as your dependency entirely, which covers a lot of chrono's surface area, while also reducing the dependency count.

acim · 2021-10-11T20:13:33Z

Many projects are using chrono, they all have to drop chrono and use time 0.3, as you suggested.

 time 0.1.44 (registry+https://github.com/rust-lang/crates.io-index)
└── chrono 0.4.19 (registry+https://github.com/rust-lang/crates.io-index)
    └── mysql_common 0.27.5 (registry+https://github.com/rust-lang/crates.io-index)
        └── mysql_async 0.28.1 (registry+https://github.com/rust-lang/crates.io-index)

time 0.1.44 (registry+https://github.com/rust-lang/crates.io-index)
├── chrono 0.4.19 (registry+https://github.com/rust-lang/crates.io-index)
│   ├── json_env_logger 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)
│   │   └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   ├── k8s-openapi 0.13.1 (registry+https://github.com/rust-lang/crates.io-index)
│   │   ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   ├── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │   ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   │   └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │       └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   ├── kube-core 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │   └── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │       ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   │       └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │           └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │       └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   ├── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │       └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   └── kube-core 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│       └── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│           ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│           └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│               └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)

Arnavion · 2021-10-11T21:15:41Z

Actually, this conversation is founded on a wrong assumption. chrono has the issue not because of its time 0.1 dependency, but because it directly calls localtime_r in the same way that time 0.1 does. AFAICT the code from time 0.1 that calls localtime_r is never called by chrono, at least not in the Local::now call path.

So unless I'm missing something, while it's unfortunate that the PR to update to time 0.3 hasn't been merged for a long time, it also won't actually fix the crash reported here.

legoktm · 2021-10-18T15:26:55Z

@Arnavion wrote:

Actually, this conversation is founded on a wrong assumption. chrono has the issue not because of its time 0.1 dependency, but because it directly calls localtime_r in the same way that time 0.1 does. AFAICT the code from time 0.1 that calls localtime_r is never called by chrono, at least not in the Local::now call path.

Should a separate security advisory be issued for chrono then, in addition to the one for time that transitively affects chrono?

CryZe · 2021-10-18T15:52:58Z

Yeah definitely.

tarcieri · 2021-10-18T15:58:41Z

I've opened a PR to add an advisory for chrono here: rustsec/advisory-db#1082

timvisee · 2021-10-18T16:14:12Z

Actually, this conversation is founded on a wrong assumption. chrono has the issue not because of its time 0.1 dependency, but because it directly calls localtime_r in the same way that time 0.1 does. AFAICT the code from time 0.1 that calls localtime_r is never called by chrono, at least not in the Local::now call path.

So unless I'm missing something, while it's unfortunate that the PR to update to time 0.3 hasn't been merged for a long time, it also won't actually fix the crash reported here.

After reading through the issues: would using a shared lock for set_var and the localtime_r invocation fix this issue?

If so, I'd be happy to try and implement it. In the hopes of it getting merged of course.

tarcieri · 2021-10-18T16:16:16Z

Per the discussion on time#293 it sounds like the best solution would be to reimplement localtime_r in pure Rust, possibly translating the implementation from Musl.

jnicholls · 2021-10-19T16:59:52Z

Per the discussion on time#293 it sounds like the best solution would be to reimplement localtime_r in pure Rust, possibly translating the implementation from Musl.

Yep I think that would be the proper thing to do longterm. And the less explicit dependency on libc, the better.

… Removing this subdependency is required by an advisory [here (CVE-2020-26235)](chronotope/chrono#602).

It is about some old version of the time crate used by chrono, but the chrono authors say that they don't actually use the affected functions. See chronotope/chrono#602 (comment)

djc · 2023-09-07T15:01:59Z

FWIW, we've released chrono 0.4.30 without the time 0.1 dependency. See the release notes for more context.

Getting rid of the old time 0.1 dependency is desirable as it isn't maintained anymore and triggers security alerts due CVE-2020-26235 [0]. The chrono crate finally dropped the dependency on time in version 0.4.30 [1]. [0]: https://github.com/science-computing/butido/security/dependabot/4 [1]: chronotope/chrono#602 (comment) Signed-off-by: Michael Weiss <michael.weiss@atos.net>

Update and lock patch versions for all dependencies. Addresses: chronotope/chrono#602

Getting rid of the old time 0.1 dependency is desirable as it isn't maintained anymore and triggers security alerts due CVE-2020-26235 [0]. The chrono crate finally dropped the dependency on time in version 0.4.30 [1]. [0]: https://github.com/science-computing/butido/security/dependabot/4 [1]: chronotope/chrono#602 (comment) Signed-off-by: Michael Weiss <michael.weiss@atos.net>

This was referenced Oct 11, 2021

The call to localtime_r may be unsound time-rs/time#293

Closed

The call to localtime_r may be unsound #499

Closed

kflansburg mentioned this issue Oct 18, 2021

RUSTSEC-2020-0071: Potential segfault in the time crate krator-rs/krator#57

Open

brycx mentioned this issue Oct 18, 2021

Security vulnerability in chrono dep time brycx/pasetors#22

Closed

gourlaysama mentioned this issue Oct 18, 2021

Look into migrating away from chrono and directly use time 0.3 gourlaysama/girouette#26

Closed

stephank mentioned this issue Oct 18, 2021

RUSTSEC-2020-0071: Potential segfault in the time crate portier/portier-broker#344

Closed

ghost mentioned this issue Oct 18, 2021

crono not maintaned - CVE-2020-26235 in time kinnison/git-testament#17

Closed

timvisee mentioned this issue Oct 18, 2021

Bump time to 0.3 #578

Closed

5 tasks

q9f mentioned this issue Oct 18, 2021

ci: ignore cargo audit for RUSTSEC-2020-0159 ChainSafe/forest#1245

Merged

clintfred mentioned this issue Oct 18, 2021

RUSTSEC-2020-0071: Potential segfault in the time crate IronCoreLabs/ironoxide#244

Closed

jumde mentioned this issue Oct 18, 2021

Fix #18835 - Suppress RUSTSEC-2020-0071 and RUSTSEC-2020-0159 advisories brave/brave-core#10573

Merged

24 tasks

q9f mentioned this issue Oct 18, 2021

Remove Cargo Audit Ignores ChainSafe/forest#1247

Closed

2 tasks

foresterre mentioned this issue Oct 18, 2021

Investigate: replace chrono with time v0.3 foresterre/rust-releases#62

Closed

tarikeshaq mentioned this issue Oct 19, 2021

Remove cargo audit ignores once chrono advisory is resolved mozilla/application-services#4590

Closed

therustmonk mentioned this issue Oct 19, 2021

RUSTSEC-2020-0071: Potential segfault in the time crate tari-project/tari#3463

Closed

pinkisemils mentioned this issue Oct 19, 2021

Change transport traits to use instance methods. hickory-dns/hickory-dns#1560

Closed

voidbar added a commit to voidbar/winstructs that referenced this issue Aug 8, 2023

Removed default features for in order to eliminate subdependency on .…

d830fe2

… Removing this subdependency is required by an advisory [here (CVE-2020-26235)](chronotope/chrono#602).

voidbar mentioned this issue Aug 8, 2023

[CVE-2020-26235] CVE Mitigation removing time@0.1.45 subdependency omerbenamram/winstructs#10

Merged

aatifsyed mentioned this issue Aug 15, 2023

Tracking issue for RUSTSEC-2020-0071 ChainSafe/forest#2627

Closed

github-actions bot mentioned this issue Aug 16, 2023

RUSTSEC-2020-0071: Potential segfault in the time crate stacks-network/clarity-wasm#22

Closed

qutax mentioned this issue Aug 16, 2023

add extended support, supports uuid and naivedatetime rust-sailfish/sailfish#129

Open

jxs mentioned this issue Aug 18, 2023

update dependencies sile/sloggers#54

Merged

mihaigalos mentioned this issue Aug 19, 2023

fix: Vulnerability CVE-2020-26235 dani-garcia/rust_async_ftp#22

Open

github-actions bot mentioned this issue Aug 21, 2023

RUSTSEC-2020-0071: Potential segfault in the time crate banyancomputer/tomb-crypt#7

Open

djc mentioned this issue Aug 22, 2023

Resolve 2 security issues #1223

Closed

This was referenced Aug 24, 2023

RUSTSEC-2020-0071: Potential segfault in the time crate KasarLabs/barknet#11

Open

RUSTSEC-2020-0071: Potential segfault in the time crate mightyshazam/port-forward-operator#7

Closed

jeremyandrews mentioned this issue Aug 26, 2023

disable default chrono features, fix potential segfault in the time crate tag1consulting/goose#559

Merged

coderedart mentioned this issue Aug 26, 2023

remove chrono dependency greaka/arcdps_bindings#12

Closed

djc mentioned this issue Aug 28, 2023

Vulnerability from time crate #1230

Closed

github-actions bot mentioned this issue Aug 31, 2023

RUSTSEC-2020-0071: Potential segfault in the time crate LeChatP/RootAsRole#33

Closed

primeos-work mentioned this issue Sep 11, 2023

Update the chrono crate to get rid of an old time 0.1 dependency science-computing/butido#281

Merged

github-actions bot mentioned this issue Sep 12, 2023

RUSTSEC-2020-0071: Potential segfault in the time crate rustic-rs/rustic_server#13

Closed

karlpvoss mentioned this issue Sep 23, 2023

Update dependencies karlpvoss/seella#13

Merged

karlpvoss added a commit to karlpvoss/seella that referenced this issue Sep 23, 2023

Update dependencies (#13)

3f41d20

Update and lock patch versions for all dependencies. Addresses: chronotope/chrono#602

karlpvoss added a commit to karlpvoss/seella that referenced this issue Sep 23, 2023

Update dependencies (#13)

7b3fd2c

Update and lock patch versions for all dependencies. Addresses: chronotope/chrono#602

github-actions bot mentioned this issue Nov 1, 2023

RUSTSEC-2020-0071: Potential segfault in the time crate gravitational/rdp-rs#37

Open

djc unpinned this issue Jan 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2020-26235 advisory for time 0.1 dependency #602

CVE-2020-26235 advisory for time 0.1 dependency #602

acim commented Oct 11, 2021

timvisee commented Oct 11, 2021 •

edited

Loading

CryZe commented Oct 11, 2021 •

edited

Loading

acim commented Oct 11, 2021

Arnavion commented Oct 11, 2021 •

edited

Loading

legoktm commented Oct 18, 2021 •

edited

Loading

CryZe commented Oct 18, 2021

tarcieri commented Oct 18, 2021

timvisee commented Oct 18, 2021 •

edited

Loading

tarcieri commented Oct 18, 2021

jnicholls commented Oct 19, 2021

djc commented Sep 7, 2023

CVE-2020-26235 advisory for time 0.1 dependency #602

CVE-2020-26235 advisory for time 0.1 dependency #602

Comments

acim commented Oct 11, 2021

timvisee commented Oct 11, 2021 • edited Loading

CryZe commented Oct 11, 2021 • edited Loading

acim commented Oct 11, 2021

Arnavion commented Oct 11, 2021 • edited Loading

legoktm commented Oct 18, 2021 • edited Loading

CryZe commented Oct 18, 2021

tarcieri commented Oct 18, 2021

timvisee commented Oct 18, 2021 • edited Loading

tarcieri commented Oct 18, 2021

jnicholls commented Oct 19, 2021

djc commented Sep 7, 2023

timvisee commented Oct 11, 2021 •

edited

Loading

CryZe commented Oct 11, 2021 •

edited

Loading

Arnavion commented Oct 11, 2021 •

edited

Loading

legoktm commented Oct 18, 2021 •

edited

Loading

timvisee commented Oct 18, 2021 •

edited

Loading