From 82010daa21a16f2285d4122c623f67fef9184d25 Mon Sep 17 00:00:00 2001 From: Souta Date: Tue, 15 Sep 2026 16:36:46 +0900 Subject: [PATCH] Take rustls 0.23.45 for RUSTSEC-2026-0285 The release for 0.5.1 went red on `cargo audit` and `cargo deny`, which is the weekly advisory scan doing the job it exists for. RUSTSEC-2026-0285: rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record -- a plaintext `EncryptedExtensions` packed in with the `ServerHello` was taken. RFC 8446 section 5.1 requires terminating with `unexpected_message` instead. Not exploitable here in the way the headline suggests. The transcript is still authenticated, so nobody alters or completes a handshake with it; and this daemon's TLS is a server on loopback that a browser on the same machine dials. Fixing it anyway, because "our deployment happens not to reach it" is a reason to be unhurried, not a reason to ship a known-defective TLS stack in a mode whose entire purpose is being a real secure context. Verified past the lockfile: the https e2e completes a real handshake against a real host and reports `isSecureContext`, which is the thing that would break if the bump had. Signed-off-by: Souta --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index e56ba67..3fdd7f3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -456,9 +456,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.44" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell",