5.3

CVE-2020-26235: time_project time NULL Pointer Dereference

CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2020-26235CGA-38j9-gp2h-5m8pCGA-39c8-4fvx-v35q
Published 24-11-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-26235 is a medium (CVSS 5.3) NULL Pointer Dereference vulnerability in time_project time. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.97%
0%100%
Low · +0.32 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 4
CGA-3QGW-PHCC-2FH2CGA-6CQ7-2MJ5-P8XCCGA-MJMH-C4XV-QXJMRUSTSEC-2020-0159

Timeline

  1. 24-11-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

1.97%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

+0.32 pp

From 1.64% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard8 products
  • berg< 0.4.7-r0
  • pgcatAll versions (No fix recorded)
  • pulumi-watch< 0.1.5-r5
  • toda< 0.2.4-r4
  • zellij< 0.41.2-r2
Wolfi7 products
  • berg< 0.4.7-r0
  • pgcatAll versions (No fix recorded)
  • pulumi-watch< 0.1.5-r5
  • zellij< 0.41.2-r2
  • zellij-bash-completion< 0.41.2-r2
Crates.Io1 product
  • time≥ 0.1.0, < 0.2.23 | ≥ 0.2.7, < 0.2.23 | ≥ 0.2.7-0, < 0.2.23
Time_project1 product
  • time≥ 0.2.7, < 0.2.23
Time-rs1 product
  • time≥ 0.2.7, < 0.2.23
Ubuntu1 product
  • rust-timeAll versions (No fix recorded)

6 vendors · 19 products

References

9 links