From cdb58604f05f6264e4d6e54dfc95528f272a1401 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Tue, 15 Sep 2026 14:50:40 -0700 Subject: [PATCH] Update rustls to 0.23.45 for RUSTSEC-2026-0285 rustls 0.23.43 accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record, where RFC 8446 requires the connection to be terminated. The transcript is still authenticated, so a handshake cannot be altered, but a peer could send in plaintext what should be encrypted. It reaches the agent through tonic -> tokio-rustls, on its mTLS gRPC link to ingest. Fixed in 0.23.45, inside the existing range, so only the lockfile moves. The advisory was published after main last passed, so the agent's cargo-deny advisories job failed on every open PR, including ones that never touched Rust. Also drops the RUSTSEC-2025-0134 ignore from agent/deny.toml. Its own reason said to delete it once tonic stopped pulling in rustls-pemfile; tonic 0.14 no longer does, and cargo-deny warned the advisory was not encountered. Signed-off-by: John Coffey --- agent/Cargo.lock | 4 ++-- agent/deny.toml | 16 ---------------- 2 files changed, 2 insertions(+), 18 deletions(-) diff --git a/agent/Cargo.lock b/agent/Cargo.lock index eab39ef..f6e1ce9 100644 --- a/agent/Cargo.lock +++ b/agent/Cargo.lock @@ -823,9 +823,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell", diff --git a/agent/deny.toml b/agent/deny.toml index 51ff068..9517449 100644 --- a/agent/deny.toml +++ b/agent/deny.toml @@ -70,22 +70,6 @@ feature-depth = 1 # A list of advisory IDs to ignore. Note that ignored advisories will still # output a note when they are encountered. ignore = [ - { id = "RUSTSEC-2025-0134", reason = """ -`rustls-pemfile` is unmaintained -- its repository was archived in -August 2025. A maintenance advisory, not a vulnerability: no CVE, no -known exploit, and the advisory itself states "No safe upgrade is -available". - -It reaches us transitively (cairnobs-agent -> tonic 0.12.3 -> -rustls-pemfile 2.2.0), so there is nothing to fix on our side; the -upstream migration is tonic's to make, to the PemObject API that -rustls-pki-types has carried since 1.9.0. The last rustls-pemfile -release is a thin wrapper over that same code, so the archived crate is -not running different logic from its replacement. - -Revisit when tonic is next upgraded -- check whether it has moved to -rustls-pki-types directly, and delete this entry if so rather than -letting it become permanent.""" }, #"RUSTSEC-0000-0000", #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" }, #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish