Skip to content

Commit

Permalink
chore: Upgrade rustls to fix security vulnerability (#3331)
Browse files Browse the repository at this point in the history
## What ❔
Upgrade rustls

## Why ❔
```
error[vulnerability]: rustls network-reachable panic in `Acceptor::accept`
    ┌─ /github/workspace/Cargo.lock:601:1
    │
601 │ rustls 0.23.16 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-[20](https://github.com/matter-labs/zksync-era/actions/runs/12011183823/job/33479628638?pr=3199#step:4:21)24-0399
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0399
    ├ A bug introduced in rustls 0.23.13 leads to a panic if the received
      TLS ClientHello is fragmented.  Only servers that use
      `rustls::server::Acceptor::accept()` are affected.
      
      Servers that use `tokio-rustls`'s `LazyConfigAcceptor` API are affected.
      
      Servers that use `tokio-rustls`'s `TlsAcceptor` API are not affected.
      
      Servers that use `rustls-ffi`'s `rustls_acceptor_accept` API are affected.
    ├ Announcement: https://github.com/rustls/rustls/issues/[22](https://github.com/matter-labs/zksync-era/actions/runs/12011183823/job/33479628638?pr=3199#step:4:23)27
    ├ Solution: Upgrade to >=0.[23](https://github.com/matter-labs/zksync-era/actions/runs/12011183823/job/33479628638?pr=3199#step:4:24).18 (try `cargo update -p rustls`)
```
  • Loading branch information
matias-gonz authored Nov 25, 2024
1 parent f4b772a commit 193c855
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 17 deletions.
32 changes: 16 additions & 16 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion deny.toml
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ ignore = [
"RUSTSEC-2020-0168", # mach dependency being unmaintained, dependency in consensus, we should consider moving to mach2 fork
"RUSTSEC-2024-0370", # `cs_derive` needs to be updated to not rely on `proc-macro-error`
# all below caused by StructOpt which we still use and we should move to clap v4 instead
"RUSTSEC-2024-0375",
"RUSTSEC-2021-0145",
"RUSTSEC-2021-0139",
"RUSTSEC-2024-0388", # `derivative` is unmaintained, crypto dependenicies (boojum, circuit_encodings and others) rely on it
Expand Down

0 comments on commit 193c855

Please sign in to comment.