Sulkta-OSS/carrier
3
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity Actions

Update Rust crate rustls to v0.23.45 [SECURITY] #21

Merged
renovate merged 1 commit from renovate/crate-rustls-vulnerability into main 2026-09-14 23:28:23 -07:00
Conversation 0 Commits 1 Files changed 1 +2 -2
renovate commented 2026-09-14 23:04:51 -07:00
Member
Copy link

This PR contains the following updates:

Package Type Update Change
rustls workspace.dependencies patch 0.23.44 → 0.23.45

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

GHSA-2mjx-qc3c-rqvc / RUSTSEC-2026-0285

More information

Details

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level
when they followed a key-changing message in the same record. For example,
a plaintext EncryptedExtensions message packed into the same record as the
ServerHello was accepted.

RFC 8446 section 5.1 requires that handshake messages do not span key changes,
and that implementations terminate the connection with an "unexpected_message"
alert if they do.

The handshake transcript is still authenticated, so a network-position attacker
cannot use this to alter or complete a handshake; the practical effect is that
a peer could send handshake messages that should be encrypted in plaintext
without rustls rejecting the connection.

This is functionally the same bug as Go's
GO-2026-4340 (CVE-2025-61730).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rustls](https://github.com/rustls/rustls) | workspace.dependencies | patch | `0.23.44` → `0.23.45` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information. --- ### TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries [GHSA-2mjx-qc3c-rqvc](https://github.com/advisories/GHSA-2mjx-qc3c-rqvc) / [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html) <details> <summary>More information</summary> #### Details Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. For example, a plaintext `EncryptedExtensions` message packed into the same record as the `ServerHello` was accepted. RFC 8446 section 5.1 requires that handshake messages do not span key changes, and that implementations terminate the connection with an "unexpected_message" alert if they do. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is that a peer could send handshake messages that should be encrypted in plaintext without rustls rejecting the connection. This is functionally the same bug as Go's [GO-2026-4340](https://pkg.go.dev/vuln/GO-2026-4340) (CVE-2025-61730). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` #### References - [https://crates.io/crates/rustls](https://crates.io/crates/rustls) - [https://rustsec.org/advisories/RUSTSEC-2026-0285.html](https://rustsec.org/advisories/RUSTSEC-2026-0285.html) - [https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc](https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc) This data is provided by [OSV](https://osv.dev/vulnerability/RUSTSEC-2026-0285) and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTMuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI1My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
renovate added 1 commit 2026-09-14 23:04:51 -07:00
Update Rust crate rustls to v0.23.45 [SECURITY]
All checks were successful
gitleaks / scan (push) Successful in 26s
Details
gitleaks / scan (pull_request) Successful in 26s
Details
1982dcec65
renovate scheduled this pull request to auto merge when all checks succeed 2026-09-14 23:04:52 -07:00
renovate merged commit 3a36d36b12 into main 2026-09-14 23:28:23 -07:00
renovate deleted branch renovate/crate-rustls-vulnerability 2026-09-14 23:28:23 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Sulkta-OSS/carrier#21
No description provided.
Delete branch "renovate/crate-rustls-vulnerability"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?