From e1bed71df8e29bcbb4cae2a4c9a925b6575d41a3 Mon Sep 17 00:00:00 2001 From: ChilePiquin Date: Mon, 14 Sep 2026 19:48:13 -0700 Subject: [PATCH] chore: ignore RUSTSEC-2026-0285 (rustls via aws-smithy-http-client) Pre-existing CI failure unrelated to this PR's change: the same "deny" job also fails on main's current tip. rustls 0.23.40 is pulled in transitively through aws-smithy-http-client; the fixed 0.23.45 release exists, but a precise bump fails to resolve against the rest of the AWS SDK dependency chain as currently pinned. Per the advisory, the handshake transcript stays authenticated regardless, so this is a hardening gap rather than an exploitable path in how this crate is used here. Follows the same ignore-with-rationale convention already used for the other aws-smithy/rustls-chain advisories in this file. Co-Authored-By: Claude Sonnet 5 --- deny.toml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/deny.toml b/deny.toml index 20510adc2..fdc7fafee 100644 --- a/deny.toml +++ b/deny.toml @@ -114,6 +114,18 @@ ignore = [ # The old copy is pulled in by aws-smithy's legacy hyper 0.14 client. # https://rustsec.org/advisories/RUSTSEC-2026-0258 { id = "RUSTSEC-2026-0258", reason = "h2 0.3 via legacy aws-smithy/hyper 0.14; no patched 0.3 release" }, + + # rustls 0.23.40: TLS 1.3 handshake messages incorrectly accepted across + # encryption level boundaries. Fixed in 0.23.45, but the copy in our + # lockfile is pinned by aws-smithy-http-client's dependency range and + # `cargo update --precise` to 0.23.45 fails to resolve against the rest + # of the AWS SDK chain as of this writing. The handshake transcript is + # still authenticated (per the advisory, this cannot be used to alter or + # complete a handshake), so this is a hardening gap, not a known + # exploitable path in how we use it. Clearing requires the aws-sdk chain + # to move to a newer aws-smithy-http-client. + # https://rustsec.org/advisories/RUSTSEC-2026-0285 + { id = "RUSTSEC-2026-0285", reason = "rustls 0.23.40 via aws-smithy-http-client; precise bump to 0.23.45 blocked by aws-sdk chain" }, ] # ---------------------------------------------------------------------------