Chrono has potential segfault issue in SPIFFE authenticator

Impact Several vulnerabilities have been reported in the time and chrono crates related to handling of calls to localtimer. You can follow some of the discussions here and here, and the associated CVE here. In our case, the issue with the dependency was flagged by our nightly CI build running...

a2 (>=0.2.0, <=0.5.3), a3mo_lib (>=0.1.0, <=0.1.1) +7024 more potentially affected by CVE-2020-26235 via time (>=0.1.25, <=0.1.45)

time CARGO version =0.1.25, =0.2.0, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.5.0, =0.1.1, =0.0.3, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: CVE-2020-26235 Source advisory: GHSA-WCG3-CVX6-7396...

a2 (>=0.2.0, <=0.5.3), a3mo_lib (>=0.1.0, <=0.1.1) +7026 more potentially affected by CVE-2020-26235 via time (>=0.1.25, <=0.2.22)

time CARGO version =0.1.25, =0.2.0, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.5.0, =0.1.1, =0.0.3, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: CVE-2020-26235 Source advisory: OSV:GHSA-WCG3-CVX6-7396...

CVE-2020-26235 vulnerabilities

Vulnerabilities for packages: berg, pulumi-watch, zellij...

CVE-2020-26235

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected...

CVE-2020-26235

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected...

CVE-2020-26235

CVE-2020-26235 affects the Rust time crate: versions 0.2.7 through before 0.2.23 can segfault on unix-like OSes when an environment variable is set from another thread, due to a dangling pointer dereference. Affected functions include time::UtcOffset::local_offset_at, try_local_offset_at, current...

a2 (>=0.2.0, <=0.5.3), a3mo_lib (>=0.1.0, <=0.1.1) +7024 more potentially affected by CVE-2020-26235 via time (>=0.1.25, <=0.1.45)

time CARGO version =0.1.25, =0.2.0, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.5.0, =0.1.1, =0.0.3, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: CVE-2020-26235 Source advisory: OSV:RUSTSEC-2020-0071...

cron-lingo (>=0.1.0, <=0.3.1), hreq (>=0.2.0, <=0.7.0) +4 more potentially affected by CVE-2020-26235 via time (>=0.2.7, <=0.2.22)

time CARGO version =0.2.7, =0.1.0, =0.2.0, =12.0.1, =0.9.1, =2.1.0, =2.2.0 Source cves: CVE-2020-26235 Source advisory: OSV:RUSTSEC-2020-0071...

abra (0.0.1), abrute (>=0.1.7, <=0.1.9) +712 more potentially affected by CVE-2020-26235 via chrono (>=0.2.16, <=0.4.19)

chrono CARGO version =0.2.16, =0.1.7, =0.1.0, =0.1.0, =0.0.11, =0.7.0, =1.1.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1, =0.1.1, =0.2.0 and more Source cves: CVE-2020-26235 Source advisory: OSV:RUSTSEC-2020-0159...