From 689944a24c920c378c81f942be24f036a47dba71 Mon Sep 17 00:00:00 2001 From: Emre Camdere Date: Fri, 16 Oct 2026 20:48:57 +0200 Subject: [PATCH] fix(deps): take rustls 0.23.46 for four new advisories RUSTSEC-2026-0346, -0347, -0348 and -0349 were published against rustls 0.23.45 after `main`'s last CI run, so its green badge was stale: the lockfile fails `cargo deny check advisories` today, and every open pull request fails the same required check for the same reason. None of the four reaches this build, and each was checked against source rather than the advisory title: - -0346 needs a custom ClientSessionStore that Debug-formats session values. Neither this project nor ureq 3.3.0 installs one. - -0347 needs a client configured for Encrypted Client Hello. Nothing here configures ECH and no enabled ureq feature turns it on. - -0348 needs rustls' non-default `brotli` feature, which is not enabled. - -0349 downgrades a client offering X25519MLKEM768. This build links the `ring` provider, which offers classical groups only; aws-lc-rs is not in the dependency graph. Taken anyway, because the advisories fail the required `cargo-deny` gate and a lockfile audit would flag the old release. Lockfile only, one package. Verified: `cargo deny check advisories` reports all four IDs on the old lockfile and `advisories ok, bans ok, licenses ok, sources ok` on the new one. Records F394: the ureq comment in codelore-lib's Cargo.toml names aws-lc-rs as the TLS backend, which would make -0349 look reachable when it is not. Claude-Session: https://claude.ai/code/session_01LRZ8yoFPCFgfZ8raBUeDeP --- CHANGELOG.md | 2 ++ Cargo.lock | 4 ++-- docs/reports/deep_analysis_report.md | 24 +++++++++++++++++++++++- 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5def8ec1..53c0eac9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ Conventional Commits format. All notable changes documented here. - **rustls accepted TLS 1.3 handshake messages across encryption-level boundaries (RUSTSEC-2026-0285).** RFC 8446 §5.1 requires that a handshake message not span a key change and that an implementation terminate the connection with an `unexpected_message` alert when one does; rustls before 0.23.45 did not, so a peer could send in plaintext handshake messages that belong after the key change and rustls would accept rather than reject the connection. The handshake transcript stays authenticated, so a network-position attacker cannot use this to alter or complete a handshake — the defect is conformance, not authentication, and it is the same bug as Go's CVE-2025-61730. It reaches this project through `ureq`, which is both a runtime dependency — the advisory enrichment layer's HTTPS client in `enrichment/client.rs` is its only caller, so the exposure is limited to runs that opt into narratives and talk to a model endpoint — and a build dependency, where `build.rs` fetches the SPA's vendored JavaScript over TLS against pinned SHAs under the `spa` feature that released binaries enable. The pinning is what bounds the build-time half: a fetch that returned altered bytes fails the digest check rather than being embedded. Resolved in the lockfile alone, `rustls` 0.23.40 → 0.23.45 and `rustls-webpki` 0.103.13 → 0.103.15, with no manifest change, because the fix is a patch release within the range already requested. Present in released builds. +- **Four further rustls advisories (RUSTSEC-2026-0346, -0347, -0348 and -0349), none of them reachable in this build.** Each has a precondition the TLS stack here does not meet. -0346 discloses the TLS 1.2 master secret or TLS 1.3 resumption PSK only through a custom `ClientSessionStore` that `Debug`-formats session values, and neither this project nor `ureq` installs one — the default in-memory cache is used. -0347 sends buffered application data to the outer server after an Encrypted Client Hello rejection, and nothing here configures ECH. -0348 lets a peer force a 1 GiB allocation through Brotli certificate decompression, which needs rustls' non-default `brotli` feature, not enabled here. -0349 lets an unauthenticated ServerHello downgrade later connections from the post-quantum `X25519MLKEM768` group to classical X25519, and the `ring` provider this build links offers classical groups only, so there is no post-quantum group to lose. Taken anyway, because `cargo deny` fails the build on any of them and an audit of the lockfile would flag the old release. Lockfile only: `rustls` 0.23.45 → 0.23.46. + ## [0.30.0] - 2026-09-09 ### Added diff --git a/Cargo.lock b/Cargo.lock index 7833d7a1..04a7ac19 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3570,9 +3570,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", diff --git a/docs/reports/deep_analysis_report.md b/docs/reports/deep_analysis_report.md index 9d039c0f..26507578 100644 --- a/docs/reports/deep_analysis_report.md +++ b/docs/reports/deep_analysis_report.md @@ -4599,4 +4599,26 @@ next has reason to open either file. Found while checking whether the new path-containment helper duplicated an existing one; it does not, but this pair does. -The next sweep re-opens at **F394**. +### F394 (Active) — a dependency comment names a TLS backend the build does not contain + +The `[build-dependencies]` note on `ureq` in `crates/codelore-lib/Cargo.toml` +says its default features give "TLS via rustls' aws-lc-rs backend". aws-lc-rs +is not in the dependency graph at all: `cargo tree -i aws-lc-rs` matches +nothing, `ureq` resolves to its `_ring` / `rustls-no-provider` features, and +rustls is built with `ring`. + +The cost is not cosmetic, because the backend decides which TLS advisories +reach this build. aws-lc-rs offers the post-quantum `X25519MLKEM768` group by +default and `ring` offers classical groups only, so RUSTSEC-2026-0349 — a +downgrade *from* that group — reads as reachable to anyone who trusts the +comment, and is in fact unreachable. A security note written from the comment +would be wrong, in the alarming direction, and would send someone looking for +an exposure that does not exist. + +The fix is a one-line correction to the comment. It is recorded rather than +applied because the change that surfaced it is a lockfile bump. + +Found while establishing which of the 2026-10 rustls advisories reach this +build. + +The next sweep re-opens at **F395**.