{"answers":{"affected":"2 open source packages ship an affected version, including parsec-service.","exploited":"There is no known exploitation of GHSA-45w3-v3g4-54pm in the wild and no public exploit code.","fix":"Upgrade parsec-service to 1.1.0 or later.","what":"GHSA-45w3-v3g4-54pm is a denial of service vulnerability in parsec-service, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-45w3-v3g4-54pm and fix it if it is affected.\n\nWhat it is: GHSA-45w3-v3g4-54pm is a denial of service vulnerability in parsec-service, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-45w3-v3g4-54pm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- parsec-service (crates.io): affected from 0.8.0; fixed in 1.1.0\n- parsec-service (crates.io): affected from 0.8.0; fixed in 1.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-45w3-v3g4-54pm/ (Markdown: https://insights.sbomify.com/GHSA-45w3-v3g4-54pm/index.md)","id":"GHSA-45w3-v3g4-54pm","markdown":"https://insights.sbomify.com/GHSA-45w3-v3g4-54pm/index.md","name":"GHSA-45w3-v3g4-54pm","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"no_fix_stated","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust SPIFFE authenticator","requires_auth":"none","summary":"A race condition in the chrono library can cause a segfault in the Parsec SPIFFE authenticator, leading to thread termination and potential service disruption.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nSeveral vulnerabilities have been reported in the `time` and `chrono` crates related to handling of calls to `localtime_r`. You can follow some of the discussions [here](https://github.com/chronotope/chrono/issues/602) and [here](https://github.com/time-rs/time/issues/293), and the associated CVE [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235). In our case, the issue with the dependency was flagged by our nightly CI build running [`cargo-audit`](https://github.com/parallaxsecond/parsec/issues/544). \n\nThe vulnerability leads to a segfault in specific circumstances - namely, when one of a number of functions in the `time` crate is called while any other thread is setting an environment variable. Given that in the case of the Parsec service this affects the SPIFFE authenticator, Parsec service users can encounter the issue only when the JWT SVID authenticator is enabled and being used. We have not undergone any manual tracing to understand if the vulnerable methods are called anywhere in our stack, however it seems reasonable to expect that if that were to be the case, the issue would lie in JWT validation (i.e. when handling the dates found within a Json Web Token). JWT validation could thus fail, bringing down the thread in which the request happens. The rest of the threads continue to work. Since the threadpool implementation that we use [continues replenishing the pool](https://docs.rs/threadpool/latest/threadpool/) when one thread panics, the impact on the service should be minimal.\n\n### Patches\nNo current patches exist as the problems lie in a number of dependencies that are not under our control (see more details [here](https://github.com/parallaxsecond/parsec/issues/544#issuecomment-1024185688)).\n\nThe issue tracking the required change in the `rust-spiffe` crate (through which the vulnerable dependencies are imported in Parsec) can be seen [here](https://github.com/maxlambrecht/rust-spiffe/issues/17). Once updates happen in our dependency chain that allow us to update beyond the vulnerable versions of `time` and `chrono`, a new version of the Parsec service will be tagged and released with the appropriate notifications.\n\n### Workarounds\nThe only complete workaround is to use a different type of authenticator with the Parsec service. \n\n### References\nAs quoted in the initial paragraph, you can find out more information:\n* in the `chrono` repo issue [here](https://github.com/chronotope/chrono/issues/602)\n* in the `time` repo issue [here](https://github.com/time-rs/time/issues/293)\n* in the official CVE report [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235)\n* in our tracking issue [here](https://github.com/parallaxsecond/parsec/issues/544)\n\n### For more information:\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Parsec service repo](https://github.com/parallaxsecond/parsec)\n* Email us at [cncf-parsec-maintainers@lists.cncf.io](mailto:cncf-parsec-maintainers@lists.cncf.io)","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Chrono has potential segfault issue in SPIFFE authenticator","id":"GHSA-45w3-v3g4-54pm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["1.1.0"],"introduced":["0.8.0"],"last_affected":[],"package":"parsec-service","purl":null,"source":"GHSA-45w3-v3g4-54pm"},{"ecosystem":"crates.io","fixed":["1.1.0"],"introduced":["0.8.0"],"last_affected":[],"package":"parsec-service","purl":"pkg:cargo/parsec-service","source":"GHSA-45w3-v3g4-54pm"}],"products":null,"published":"2022-02-11","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A race condition in the chrono library can cause a segfault in the Parsec SPIFFE authenticator, leading to thread termination and potential service disruption.","url":"https://insights.sbomify.com/GHSA-45w3-v3g4-54pm/"}