Potential segfault in the time crate <table role="table

Once this PR is merged - <a class="issue-link js-issue-link" data-error-text="Failed

RUSTSEC-2020-0071: Potential segfault in the time crate about qsv HOT 6 CLOSED

jqnatividad commented on May 18, 2024

RUSTSEC-2020-0071: Potential segfault in the time crate

from qsv.

Comments (6)

jqnatividad commented on May 18, 2024

time is a dependency of chrono, which we only use to get MIDNIGHT

qsv/src/cmd/apply.rs

Lines 124 to 126 in 3584695

    
           lazy_static! { 
        
               static ref MIDNIGHT: chrono::NaiveTime = NaiveTime::from_hms(0, 0, 0); 
        
           }

and we do not use the affected functions in the advisory.

Regardless, there is a pending PR upstream on both chrono and time, so a fix is imminent and will be applied to eliminate this GitHub bot security advisory.

from qsv.

github-actions commented on May 18, 2024

Stale issue message

from qsv.

jqnatividad commented on May 18, 2024

Once this PR is merged - chronotope/chrono#639, this will take care of this issue.

from qsv.

jqnatividad commented on May 18, 2024

This remains a false positive. Regardless, chrono 0.4.20-rc.1 is now a release candidate,
https://github.com/chronotope/chrono/releases/tag/v0.4.20-rc.1

Once its released, we'll use it and close this advisory.

from qsv.

jqnatividad commented on May 18, 2024

We are now using chrono 0.4.20 - which no longer depends on the vulnerable parts of the time 0.1.x versions - which is the cause of this security advisory.

Once chrono 0.5.0 is released, where time 0.1.x will be removed, this advisory will no longer be triggered during a cargo audit.

from qsv.

github-actions commented on May 18, 2024

Stale issue message

from qsv.

Recommend Projects