L. C. Hsieh created SPARK-60371:
-----------------------------------
Summary: Update quinn-proto and rustls in Cargo.lock to pick up
recent RustSec advisories
Key: SPARK-60371
URL: https://issues.apache.org/jira/browse/SPARK-60371
Project: Spark
Issue Type: Sub-task
Components: Connect
Affects Versions: connect-gateway-0.1.0
Reporter: L. C. Hsieh
Assignee: L. C. Hsieh
`cargo audit` against main (af4f080) reports nine advisories published in the
last week, all with fixed releases. This updates the two affected crates in
Cargo.lock only; no Cargo.toml change is needed.
quinn-proto 0.11.16 -> 0.11.19 (fixed in >= 0.11.18)
RUSTSEC-2026-0338 zero-length STREAM frames can panic during unordered reads
RUSTSEC-2026-0339 unbounded growth of pending connection ID retirements
RUSTSEC-2026-0340 peer minimum ACK delay can panic with ACK_FREQUENCY
RUSTSEC-2026-0341 stream reassembly memory-exhaustion guard can be bypassed
RUSTSEC-2026-0342 zero-length DATAGRAM frames bypass the receive buffer limit
The gateway is not exposed: quinn is enabled only by reqwest's `http3`
feature, which the workspace does not turn on (reqwest is built with
`rustls-tls` and `json`). quinn-proto appears in Cargo.lock but is never
compiled. `cargo audit` reads the lockfile rather than the build graph, so
it still reports these, and updating is preferable to ignoring advisories
that have a fix.
rustls 0.23.45 -> 0.23.46
RUSTSEC-2026-0346 Debug impls for client session values expose TLS secrets
RUSTSEC-2026-0347 buffered application data sent to outer server after ECH
rejection
RUSTSEC-2026-0348 brotli certificate decompression can allocate up to 1 GiB
before authentication
RUSTSEC-2026-0349 unauthenticated ServerHello can downgrade later
connections to classical key exchange
The gateway uses rustls only as a TLS client (kube-client for the K8s API,
reqwest for OIDC JWKS, opentelemetry-otlp), so these do apply. They are fixed
in a patch release.
This is a prerequisite for SPARK-60370: the audit workflow fails while any of
these advisories is present.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
