CVE-2020-26235 advisory for time 0.1 dependency

[acim]

Please update time dependency.

Inverse Dependency graph
time 0.1.44 (registry+https://github.com/rust-lang/crates.io-index)
└── chrono 0.4.19 (registry+https://github.com/rust-lang/crates.io-index)

[timvisee]

Yes!

I've prepared a PR for it some time ago, but it hasn't been merged yet: #578

[CryZe]

Everything below 0.2.7 is unaffected:
https://github.com/rustsec/advisory-db/blob/main/crates/time/RUSTSEC-2020-0071.md?plain=1#L36

However chrono does seem somewhat unmaintained, so maybe it makes sense to just switch to time 0.3 as your dependency entirely, which covers a lot of chrono's surface area, while also reducing the dependency count.

[acim]

Many projects are using chrono, they all have to drop chrono and use time 0.3, as you suggested.

 time 0.1.44 (registry+https://github.com/rust-lang/crates.io-index)
└── chrono 0.4.19 (registry+https://github.com/rust-lang/crates.io-index)
    └── mysql_common 0.27.5 (registry+https://github.com/rust-lang/crates.io-index)
        └── mysql_async 0.28.1 (registry+https://github.com/rust-lang/crates.io-index)

time 0.1.44 (registry+https://github.com/rust-lang/crates.io-index)
├── chrono 0.4.19 (registry+https://github.com/rust-lang/crates.io-index)
│   ├── json_env_logger 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)
│   │   └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   ├── k8s-openapi 0.13.1 (registry+https://github.com/rust-lang/crates.io-index)
│   │   ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   ├── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │   ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   │   └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │       └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   ├── kube-core 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │   └── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │       ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   │       └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   │           └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │       └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   ├── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │   ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   │   └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│   │       └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│   └── kube-core 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│       └── kube 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│           ├── bond 0.1.5 (path+file:///home/runner/work/bond/bond)
│           └── kube-runtime 0.61.0 (registry+https://github.com/rust-lang/crates.io-index)
│               └── bond 0.1.5 (path+file:///home/runner/work/bond/bond)

[Arnavion]

Actually, this conversation is founded on a wrong assumption. chrono has the issue not because of its time 0.1 dependency, but because it directly calls localtime_r in the same way that time 0.1 does. AFAICT the code from time 0.1 that calls localtime_r is never called by chrono, at least not in the Local::now call path.

So unless I'm missing something, while it's unfortunate that the PR to update to time 0.3 hasn't been merged for a long time, it also won't actually fix the crash reported here.