From c99f4811242cb007572511be584e24d86caec54e Mon Sep 17 00:00:00 2001 From: rays Date: Fri, 23 Oct 2026 13:43:09 +0000 Subject: [PATCH] Update rustls-webpki, webpki-roots and ctutils for three advisories (#351) cargo deny check failed on main: - RUSTSEC-2026-0382, rustls-webpki 0.103.15: verification may accept distrusted intermediates. Now 0.103.16. - RUSTSEC-2026-0381, webpki-roots 1.0.9: bundled roots trust distrusted emSign intermediates. Now 1.0.11. It surfaced once the first was fixed. - RUSTSEC-2026-0385, ctutils 0.4.2: non-constant-time masks and u128 comparisons. Now 0.4.5. All transitive; Cargo.lock only. cargo deny check passes. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 12 ++++++------ crates/directory/CHANGELOG.md | 4 ++++ crates/ipx/CHANGELOG.md | 1 + 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index fa5075a..0441b92 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -800,9 +800,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", ] @@ -3628,9 +3628,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -5111,9 +5111,9 @@ dependencies = [ [[package]] name = "webpki-roots" -version = "1.0.9" +version = "1.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a" +checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171" dependencies = [ "rustls-pki-types", ] diff --git a/crates/directory/CHANGELOG.md b/crates/directory/CHANGELOG.md index 3a2eb24..533da9d 100644 --- a/crates/directory/CHANGELOG.md +++ b/crates/directory/CHANGELOG.md @@ -14,6 +14,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - A WordPress.com site that answers its feed with a browser check (HTTP 403) is read from WordPress.com's API instead of failing (#317). +### Security + +- HTTPS connections no longer trust certificates from emSign's distrusted intermediates, and certificate checks use constant-time comparisons: rustls-webpki, webpki-roots and ctutils are updated (#351). + ## [1.3.0] - 2026-10-19 ### Added diff --git a/crates/ipx/CHANGELOG.md b/crates/ipx/CHANGELOG.md index 160658b..d3fa5a8 100644 --- a/crates/ipx/CHANGELOG.md +++ b/crates/ipx/CHANGELOG.md @@ -27,6 +27,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - An OPML nested more than 100 levels deep is refused, uploaded or fetched. A deep enough one stopped iPX, and a subscribed one stopped it again each time it restarted (#322). - A `.torrent` file larger than 10 MB, or slower than the torrent stall limit, is refused. iPX read one into memory however large it was (#330). - Feeds, episodes, artwork and `.torrent` files are no longer fetched from internal addresses (loopback, the LAN, Docker's networks), redirects included, unless config.toml's `fetch_internal` lists them. Adding a feed could read what a service inside the network answered (#320). +- HTTPS connections no longer trust certificates from emSign's distrusted intermediates, and certificate checks use constant-time comparisons: rustls-webpki, webpki-roots and ctutils are updated (#351). ## [1.4.0] - 2026-10-19