RUSTSEC-2020-0159: Potential segfault in `localtime_r` invocations

[github-actions[bot]]

trafficstars

Potential segfault in localtime_r invocations

Details
Package	chrono
Version	0.4.19
URL	https://github.com/chronotope/chrono/issues/499
Date	2020-11-10

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

• time-rs/time#293

See advisory page for additional details.

[mfelsche]

Dependencies that reference chrono::Local::now() which seems to be the only path that executes localtime_r are:

• syslog_loose - but we don't use that path anywhere in our code.
• log4rs - if a pattern like {d(%Y...)(local)} is used, which is totally up to the users, we cannot control this.

[Licenser]

this seems to have been resolved in current versions