From 8ea3410c82cffe62be9767d47226d7b37f1531d1 Mon Sep 17 00:00:00 2001 From: le king fu Date: Mon, 21 Sep 2026 20:09:39 -0400 Subject: [PATCH] fix(deps): update rustls to 0.23.45 to clear RUSTSEC-2026-0285 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The daily audit has failed every morning since 2026-09-15 (runs 405 to 411, 7 consecutive reds). Nothing was pushed to main in that window — the last commit is 97ee3c3 from 09-13. RUSTSEC-2026-0285 was published on 09-14, after that morning's run, and the first red is the next day's. Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message inside the same record, where RFC 8446 section 5.1 requires closing the connection instead. Medium severity, confidentiality only: the handshake transcript stays authenticated, so this cannot be used to alter or complete a handshake from a network position. Patched in 0.23.45. rustls is reachable on both shipped targets, checked per triple rather than with --target all, by a single path: tauri-plugin-updater -> reqwest 0.13.2, the automatic update check and download. That is narrower than h2 in #343 — the app's own reqwest 0.12.28 goes through hyper-tls and native-tls, so the licence, auth, price and feedback calls were never on this path. A published fix plus a reachable crate is rule 1 of .cargo/audit.toml, so this gets fixed rather than suppressed; the suppression list and the check-rust guard are both untouched. rustls-webpki moves with it, 0.103.13 to 0.103.15, because 0.23.45 tightens its bound from ^0.103.5 to ^0.103.14. That is required rather than collateral, and it keeps the four advisories #310 cleared by pinning 0.103.13. Unlike #344, no stanza was hand-written: `cargo update -p rustls --precise 0.23.45` left the seven windows-sys pointers on 0.61.2 untouched, so cargo's own output was kept. That also narrows the premise of #345 — the drift is triggered by hyper and what it pulls, not by the TLS subtree at large, since rustls sits squarely in it and moved nothing. 666 packages before and after, Cargo.toml untouched, and `cargo metadata --locked` accepts the result without rewriting it. Verified: cargo check --locked and cargo test --locked green (111 passed), cargo-audit 0.22.2 exits 0 with 12 allowed warnings, and the same binary still exits 1 on the previous lockfile — so the green is a real change of state, not a differently configured tool. Both checksums match the sha256 of the downloaded .crate archives, and compiling rustls 0.23.45 and rustls-webpki 0.103.15 proves those archives were the ones actually used. Resolves #348 Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.fr.md | 4 ++++ CHANGELOG.md | 4 ++++ src-tauri/Cargo.lock | 8 ++++---- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.fr.md b/CHANGELOG.fr.md index f2d2408..976c1e7 100644 --- a/CHANGELOG.fr.md +++ b/CHANGELOG.fr.md @@ -2,6 +2,10 @@ ## [Non publié] +### Sécurité + +- Mise à jour de la dépendance Rust `rustls` (0.23.36 → 0.23.45, qui exige `rustls-webpki` 0.103.13 → 0.103.15 avec elle), corrigeant RUSTSEC-2026-0285. Les messages de poignée de main TLS 1.3 étaient acceptés au mauvais niveau de chiffrement lorsqu'ils suivaient un message de changement de clé dans le même enregistrement — un `EncryptedExtensions` en clair empaqueté avec le `ServerHello`, par exemple — là où la RFC 8446 impose de fermer la connexion. Sévérité moyenne, confidentialité seulement : la transcription de la poignée de main reste authentifiée, donc cela ne permet ni d'altérer ni de compléter une poignée de main depuis une position réseau ; l'effet est qu'un pair peut envoyer en clair ce qui aurait dû être chiffré sans que rustls refuse la connexion. `rustls` est la couche TLS de la vérification et du téléchargement des mises à jour automatiques, atteinte via `tauri-plugin-updater` — les appels de licence, d'authentification, de cours et de rétroaction de l'application elle-même passent par un autre moteur TLS et n'ont jamais été sur ce chemin. Aucun changement de comportement : seul le fichier de verrouillage bouge, `Cargo.toml` est intouché (#348). + ## [0.15.0] - 2026-09-12 ### Ajouté diff --git a/CHANGELOG.md b/CHANGELOG.md index 95fa9dc..ee6f1ee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ ## [Unreleased] +### Security + +- Updated the Rust dependency `rustls` (0.23.36 → 0.23.45, which requires `rustls-webpki` 0.103.13 → 0.103.15 alongside it), clearing RUSTSEC-2026-0285. TLS 1.3 handshake messages were accepted at the wrong encryption level when they followed a key-changing message inside the same record — a plaintext `EncryptedExtensions` packed together with the `ServerHello`, for instance — where RFC 8446 requires closing the connection instead. Medium severity, confidentiality only: the handshake transcript stays authenticated, so this cannot be used to alter or complete a handshake from a network position; the effect is that a peer can send in the clear what should have been encrypted without rustls refusing the connection. `rustls` is the TLS layer of the automatic update check and download, reached through `tauri-plugin-updater` — the application's own licence, authentication, market-price and feedback calls use a different TLS backend and were never on this path. No behaviour change: only the lockfile moves, `Cargo.toml` is untouched (#348). + ## [0.15.0] - 2026-09-12 ### Added diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index a8e0d91..7edfc7f 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -4049,9 +4049,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.36" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -4111,9 +4111,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",