Repository navigation
security(deps): rustls 0.23.45 for RUSTSEC-2026-0285 - #53
Merged
Merged
Conversation
rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record, so a plaintext message packed into the same record as an encrypted one was taken as legitimate. Advisory published 2026-09-14; patched in 0.23.45, and the lock was at 0.23.43. A lock-only bump inside 0.23, so nothing is rewritten: `cargo check --workspace --all-targets --locked` passes, and `cargo deny check` returns advisories/bans/licenses/sources all ok. rustls is not a direct dependency: it arrives through reqwest, hyper-rustls, tokio-rustls and aws-smithy-http-client, so there is no manifest to edit. Separate from the termlens bump on purpose — that one moves a test harness and this one closes a TLS hole; they should be revertible apart. Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cargo denybegan failing on RUSTSEC-2026-0285 — rustls accepted TLS 1.3 handshake messages at the wrong encryption level when they followed a key-changing message in the same record. Advisory published 2026-09-14, the day after this repository's last greenmainrun, so it redsmainand every open PR rather than anything a branch did.Locked at 0.23.43; patched at ≥ 0.23.45. rustls is not a direct dependency — it arrives via reqwest, hyper-rustls, tokio-rustls and aws-smithy-http-client — so this is lock-only.
Checked:
cargo deny check→ advisories ok, bans ok, licenses ok, sources ok.cargo check --workspace --all-targets --lockedpasses.Kept separate from #52 (the termlens 0.11.2 bump) deliberately: that one moves a test harness, this closes a TLS hole, and they should be revertible apart. #52 is blocked on this and will go green once this lands and it rebases.
One thing noticed, not fixed here: the
GHSA-2f9f-gq7v-9h6mignore indeny.toml:37now warns twice —unknown advisoryandadvisory was not encountered. The thrift path it was written for no longer matches, so that entry looks ready to retire; worth its own look rather than riding along with a security fix.