Rust advisories / iana-time-zone
Unsound MediumRUSTSEC-2022-0049 · iana-time-zone
RUSTSEC-2022-0049: Use after free in MacOS / iOS implementation
Short answeriana-time-zone has an API that can cause undefined behaviour from safe code: Use after free in MacOS / iOS implementation. Fixed in 0.1.45.
| Crate | iana-time-zone |
|---|---|
| Type | Unsound (memory-exposure) |
| Affected versions | From 0.1.43 before 0.1.45. |
| Fixed in | 0.1.45 |
| Severity | Medium (GitHub rating) |
| Published | 2022-08-15 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-3fg9-hcq5-vxrc |
| Affected functions | iana_time_zone::get_timezone |
What to do
- See which version you have:
cargo tree -i iana-time-zone(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p iana-time-zone. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleiana-time-zone = "0.1.45") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.
The copied system time zone was released before its name was copied. If the system time zone was changed between the call of CFRelease and str::to_owned(), random memory would be copied.
References
- Package: crates.io/crates/iana-time-zone
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0049.html
- Web: github.com/strawlab/iana-time-zone/pull/54
- Web: github.com/strawlab/iana-time-zone/pull/50#discussion_r945353515
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same crateiana-time-zone: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?