search

FlorianUekermann / rustls-acme

Apache License 2.0
136 stars 27 forks source link

Patch CVE-2020-26235 for chrono crate #43

Closed tyjvazum closed 1 year ago

tyjvazum commented 1 year ago

I'm using the rustls-acme crate in arb, where I encountered a security alert (discussed here) due to the version of the time crate that the chrono crate was using. I fixed it in arb, but the issue persisted since rustls-acme also uses chrono, so I made this small change to the Cargo.toml file to fix it. I've tested everything and am confident it's the correct fix, until chrono is able to release a version that they plan on removing the time dependency from entirely.

I'm using a patched version of rustls-acme for arb in the meantime (which if looked at, please ignore the formatting changes that were required by my workflow), that I'd prefer to remove if this change can be merged into the rustls-acme crate.

FlorianUekermann commented 1 year ago

Seems like my comment got lost... Thank you for the PR, I released a new version, which includes the commit.

tyjvazum commented 1 year ago

Thank you for the quick response, I've switched from my patched version to your new release 👍