diff --git a/CHANGELOG.md b/CHANGELOG.md index 5def8ec1..53c0eac9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ Conventional Commits format. All notable changes documented here. - **rustls accepted TLS 1.3 handshake messages across encryption-level boundaries (RUSTSEC-2026-0285).** RFC 8446 §5.1 requires that a handshake message not span a key change and that an implementation terminate the connection with an `unexpected_message` alert when one does; rustls before 0.23.45 did not, so a peer could send in plaintext handshake messages that belong after the key change and rustls would accept rather than reject the connection. The handshake transcript stays authenticated, so a network-position attacker cannot use this to alter or complete a handshake — the defect is conformance, not authentication, and it is the same bug as Go's CVE-2025-61730. It reaches this project through `ureq`, which is both a runtime dependency — the advisory enrichment layer's HTTPS client in `enrichment/client.rs` is its only caller, so the exposure is limited to runs that opt into narratives and talk to a model endpoint — and a build dependency, where `build.rs` fetches the SPA's vendored JavaScript over TLS against pinned SHAs under the `spa` feature that released binaries enable. The pinning is what bounds the build-time half: a fetch that returned altered bytes fails the digest check rather than being embedded. Resolved in the lockfile alone, `rustls` 0.23.40 → 0.23.45 and `rustls-webpki` 0.103.13 → 0.103.15, with no manifest change, because the fix is a patch release within the range already requested. Present in released builds. +- **Four further rustls advisories (RUSTSEC-2026-0346, -0347, -0348 and -0349), none of them reachable in this build.** Each has a precondition the TLS stack here does not meet. -0346 discloses the TLS 1.2 master secret or TLS 1.3 resumption PSK only through a custom `ClientSessionStore` that `Debug`-formats session values, and neither this project nor `ureq` installs one — the default in-memory cache is used. -0347 sends buffered application data to the outer server after an Encrypted Client Hello rejection, and nothing here configures ECH. -0348 lets a peer force a 1 GiB allocation through Brotli certificate decompression, which needs rustls' non-default `brotli` feature, not enabled here. -0349 lets an unauthenticated ServerHello downgrade later connections from the post-quantum `X25519MLKEM768` group to classical X25519, and the `ring` provider this build links offers classical groups only, so there is no post-quantum group to lose. Taken anyway, because `cargo deny` fails the build on any of them and an audit of the lockfile would flag the old release. Lockfile only: `rustls` 0.23.45 → 0.23.46. + ## [0.30.0] - 2026-09-09 ### Added diff --git a/Cargo.lock b/Cargo.lock index 7833d7a1..04a7ac19 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3570,9 +3570,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", diff --git a/docs/reports/deep_analysis_report.md b/docs/reports/deep_analysis_report.md index 9d039c0f..26507578 100644 --- a/docs/reports/deep_analysis_report.md +++ b/docs/reports/deep_analysis_report.md @@ -4599,4 +4599,26 @@ next has reason to open either file. Found while checking whether the new path-containment helper duplicated an existing one; it does not, but this pair does. -The next sweep re-opens at **F394**. +### F394 (Active) — a dependency comment names a TLS backend the build does not contain + +The `[build-dependencies]` note on `ureq` in `crates/codelore-lib/Cargo.toml` +says its default features give "TLS via rustls' aws-lc-rs backend". aws-lc-rs +is not in the dependency graph at all: `cargo tree -i aws-lc-rs` matches +nothing, `ureq` resolves to its `_ring` / `rustls-no-provider` features, and +rustls is built with `ring`. + +The cost is not cosmetic, because the backend decides which TLS advisories +reach this build. aws-lc-rs offers the post-quantum `X25519MLKEM768` group by +default and `ring` offers classical groups only, so RUSTSEC-2026-0349 — a +downgrade *from* that group — reads as reachable to anyone who trusts the +comment, and is in fact unreachable. A security note written from the comment +would be wrong, in the alarming direction, and would send someone looking for +an exposure that does not exist. + +The fix is a one-line correction to the comment. It is recorded rather than +applied because the change that surfaced it is a lockfile bump. + +Found while establishing which of the 2026-10 rustls advisories reach this +build. + +The next sweep re-opens at **F395**.