GHSA-45W3-V3G4-54PM

Chrono has potential segfault issue in SPIFFE authenticator

Workarounds

The only complete workaround is to use a different type of authenticator with the Parsec service.

References

As quoted in the initial paragraph, you can find out more information:

• in the chrono repo issue here
• in the time repo issue here
• in the official CVE report here
• in our tracking issue here

For more information:

If you have any questions or comments about this advisory:

• Open an issue in the Parsec service repo
• Email us at [email protected]

Several vulnerabilities have been reported in the time and chrono crates related to handling of calls to localtime_r. You can follow some of the discussions here and here, and the associated CVE here. In our case, the issue with the dependency was flagged by our nightly CI build running cargo-audit.

The vulnerability leads to a segfault in specific circumstances - namely, when one of a number of functions in the time crate is called while any other thread is setting an environment variable. Given that in the case of the Parsec service this affects the SPIFFE authenticator, Parsec service users can encounter the issue only when the JWT SVID authenticator is enabled and being used. We have not undergone any manual tracing to understand if the vulnerable methods are called anywhere in our stack, however it seems reasonable to expect that if that were to be the case, the issue would lie in JWT validation (i.e. when handling the dates found within a Json Web Token). JWT validation could thus fail, bringing down the thread in which the request happens. The rest of the threads continue to work. Since the threadpool implementation that we use continues replenishing the pool when one thread panics, the impact on the service should be minimal.

The application dereferences a null pointer, causing a crash. Typical impact: denial of service via crash.

Kodem intelligence

Already deployed Kodem?

No current patches exist as the problems lie in a number of dependencies that are not under our control (see more details here).

The issue tracking the required change in the rust-spiffe crate (through which the vulnerable dependencies are imported in Parsec) can be seen here. Once updates happen in our dependency chain that allow us to update beyond the vulnerable versions of time and chrono, a new version of the Parsec service will be tagged and released with the appropriate notifications.

1. What is GHSA-45W3-V3G4-54PM? GHSA-45W3-V3G4-54PM is a low-severity null pointer dereference vulnerability in parsec-service (rust), affecting versions >= 0.8.0, < 1.1.0. It is fixed in 1.1.0. The application dereferences a null pointer, causing a crash.
2. Which versions of parsec-service are affected by GHSA-45W3-V3G4-54PM? parsec-service (rust) versions >= 0.8.0, < 1.1.0 is affected.
3. Is there a fix for GHSA-45W3-V3G4-54PM? Yes. GHSA-45W3-V3G4-54PM is fixed in 1.1.0. Upgrade to this version or later.
4. Is GHSA-45W3-V3G4-54PM exploitable, and should I be worried? Whether GHSA-45W3-V3G4-54PM is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-45W3-V3G4-54PM is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-45W3-V3G4-54PM? Upgrade parsec-service to 1.1.0 or later.