RUSTSEC-2026-0346: `Debug` impls for client session values expose TLS secrets
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
Research direction
The vulnerable dependency is rustls 0.23.45, so start in Cargo.toml and Cargo.lock where it is pinned, and run cargo tree -i rustls to see which crates pull it in. Update the lock to 0.23.46 or later with cargo update -p rustls, then run the test suite and build. Done when cargo tree -i rustls reports 0.23.46 or newer and the build passes.
Written by the indexing model from the issue text.
Description
Debugimpls for client session values expose TLS secrets
| Details | |
|---|---|
| Package | rustls |
| Version | 0.23.45 |
| URL | https://github.com/rustls/rustls/pull/3299 |
| Date | 2026-10-14 |
| Patched versions | >=0.23.46 |
| Unaffected versions | <0.21.0 |
The Debug implementations of Tls12ClientSessionValue and
Tls13ClientSessionValue were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.
Custom ClientSessionStore implementations that format these values with
Debug (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
key-material redaction policy.
Ordinary connection and built-in session cache Debug output is redacted and
is not affected.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 1
- Forks
- 0
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/stackable-odbc-trino
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authenticationOpen
Difficulty 2/5 1-3 hours Newbie friendliness 50/100
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
All issues in stackabletech/stackable-odbc-trino
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
ActivityWatch/aw-notify-rs#47 · 1 comment ·
-
`inverse()` of a controlled `CUGate` drops the phase parameter γPossibly taken @rupasri118 claimed this today. Openbug mod: circuit
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Qiskit/qiskit#17223 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
Maintainers usually reply within 2 days
-
agent:triaged bug bughunt pm:bundler priority:p1
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
SocketDev/socket-patch#1573 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
bytecodealliance/rustix#1706 · 1 comment ·
Maintainers usually reply within 11 days