RUSTSEC-2021-0073: Conversion from prost_types::Timestamp to SystemTime can cause an overflow and panic

[github-actions]

Conversion from prost_types::Timestamp to SystemTime can cause an overflow and panic

Details
Package	prost-types
Version	0.7.0
URL	tokio-rs/prost#438
Date	2021-07-08
Patched versions	>=0.8.0

Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime.

It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.

See #438 for more information.

See advisory page for additional details.

[JelleMillenaar]

@cycraig I believe you already looked at this? Didn't we just have to wait for tokio to update a dependency? Does that mean we close this or do we keep it open to remind ourselves to update tokio?

[cycraig]

The dependency is libp2p I think and it has since been updated to use a later version of prost-build and prost-types.

I do wonder whether we need to change our usage of SystemTime in libjose to avoid the same issue, however:

impl TimeCop {
  /// Creates a new `TimeCop`.
  pub const fn new() -> Self {
    Self {
      current: None,
      max_iat: None,
      min_iat: None,
    }
  }

  pub fn set_current(&mut self, value: impl Into<SystemTime>) {
    self.current = Some(value.into());
  }

Since Into<SystemTime> could be vulnerable depending on what implements it. We don't use TimeCop::set_current anywhere so maybe the function should be removed to avoid any potential problems down the line?