New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix cargo audit and add to CI check #8953

Closed

xxchan opened this issue Apr 3, 2023 · 1 comment · Fixed by #8959

Milestone

Member

xxchan commented Apr 3, 2023

No description provided.

github-actions bot added this to the release-0.19 milestone

Member Author

xxchan commented Apr 3, 2023 •

edited

Loading

Crate:     time
Version:   0.1.45
Title:     Potential segfault in the time crate
Date:      2020-11-18
ID:        RUSTSEC-2020-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0071
Solution:  Upgrade to >=0.2.23
Dependency tree:
time 0.1.45
└── chrono 0.4.24

This is a false positive:

We depends on chrono, but not time, and chrono is not affected by RUSTSEC-2020-0071 (see The call to localtime_r may be unsound time-rs/time#293 (comment)).
chrono also suffers from a similar vulnerability (RUSTSEC-2020-0159, but it's already patched in 0.4.20 by rewriting vulnerable C function in Rust).

P.S. The false positive problem of advisory-db is an unsolved problem. See rustsec/advisory-db#288 (comment)

xxchan mentioned this issue

fix: fix cargo audit issues and add audit to ci #8959

Merged

1 task

xxchan closed this as completed in #8959

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment