Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

disable default chrono features, fix potential segfault in the time crate #559

Merged
merged 1 commit into from
Aug 28, 2023

Conversation

jeremyandrews
Copy link
Member

@jeremyandrews jeremyandrews commented Aug 25, 2023

A possible workaround for crates affected through the transitive dependency in chrono, is to avoid using the default oldtime feature dependency of the chrono crate by disabling its default-features and manually specifying the required features instead.

This fixes the following issue detailed at the link above:

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

@jeremyandrews jeremyandrews changed the title disable default chrono features disable default chrono features, fix potential segfault in the time crate Aug 26, 2023
@jeremyandrews
Copy link
Member Author

jeremyandrews commented Aug 26, 2023

@LionsAd I don't see the need to declare this a security release, worst-case it seems anther user on the server running the load test could cause the load test to segfault. In general, it would be unwise to run a load test on a shared server anyway. If you agree, we can go ahead and merge as-is.

CHANGELOG.md Outdated
@@ -2,6 +2,7 @@

## 0.17.2-dev
- [#557](https://github.com/tag1consulting/goose/pull/557) speed up user initialization on Linux
- []() disable unnecessary features in chronos, avoid potential segfault in time crate: https://rustsec.org/advisories/RUSTSEC-2020-0071
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Link missing.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh my! Thank you :)

@slashrsm slashrsm merged commit c4d128f into tag1consulting:main Aug 28, 2023
2 checks passed
@jeremyandrews jeremyandrews mentioned this pull request Aug 28, 2023
@jeremyandrews jeremyandrews deleted the chronos branch September 11, 2023 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Potential segfault in the time crate CVE-2020-26235 advisory for time 0.1 dependency
4 participants