From 0f8eb6d3ab62065f082fc2eaeeb8b992fcf7443f Mon Sep 17 00:00:00 2001 From: Edouard Vanbelle Date: Mon, 4 May 2026 14:25:45 +0200 Subject: [PATCH] chore: audit: ignore rustls-webpki 0.101.7 issue MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit # rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12. # aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available. # Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure. # RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed). # RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance). # RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance). "RUSTSEC-2026-0104", "RUSTSEC-2026-0098", "RUSTSEC-2026-0099", # instant unmaintained — transitive via azure_core 0.21.0 (latest available). # No direct security impact; no upgrade path exists. "RUSTSEC-2024-0384", --- .cargo/audit.toml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 7a4cd0b5..51ac2ffc 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -12,4 +12,18 @@ ignore = [ # Not affected: This application uses HS256 for internal JWT signing and only performs # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens. "RUSTSEC-2023-0071", + + # rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12. + # aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available. + # Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure. + # RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed). + # RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance). + # RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance). + "RUSTSEC-2026-0104", + "RUSTSEC-2026-0098", + "RUSTSEC-2026-0099", + + # instant unmaintained — transitive via azure_core 0.21.0 (latest available). + # No direct security impact; no upgrade path exists. + "RUSTSEC-2024-0384", ]