[
https://issues.apache.org/jira/browse/SPARK-60591?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
L. C. Hsieh resolved SPARK-60591.
---------------------------------
Fix Version/s: connect-gateway-0.1.0
Resolution: Fixed
Issue resolved by pull request 55
[https://github.com/apache/spark-connect-gateway/pull/55]
> Ignore RUSTSEC-2026-0387 (crypto-bigint) in cargo audit and track it until a
> fix is reachable
> ---------------------------------------------------------------------------------------------
>
> Key: SPARK-60591
> URL: https://issues.apache.org/jira/browse/SPARK-60591
> Project: Spark
> Issue Type: Sub-task
> Components: Connect
> Affects Versions: connect-gateway-0.1.0
> Reporter: L. C. Hsieh
> Assignee: L. C. Hsieh
> Priority: Major
> Labels: pull-request-available
> Fix For: connect-gateway-0.1.0
>
>
> `cargo audit` reports RUSTSEC-2026-0387 against crypto-bigint 0.5.5:
> "Multiple timing variability issues in operations intended to be
> constant-time" (published 2026-10-23). The fix is in crypto-bigint 0.7.6,
> which
> the current dependency graph cannot use. It is the scheduled audit run's only
> remaining failure once SPARK-60590 lands.
> How it reaches the gateway: jsonwebtoken's rust_crypto provider (selected in
> SPARK-59552) uses p256 / p384 for ES256 / ES384, which go through ecdsa 0.16
> and elliptic-curve 0.13 to crypto-bigint 0.5. jsonwebtoken 11 (#39) resolves
> the same versions, so upgrading it does not help.
> The gateway's exposure is low, for the same reason as RUSTSEC-2023-0071 (rsa,
> SPARK-60369). Timing variability in supposedly constant-time arithmetic
> matters
> when the operands are secret, i.e. during private-key operations. The gateway
> only verifies JWT signatures with public keys: production code uses
> DecodingKey (from_ec_pem, from_ec_components, and the RSA/Ed25519/HMAC
> equivalents), and every EncodingKey or signing use is inside #[cfg(test)].
> Verification works only on public values, so there is nothing secret to leak.
> Plan:
> 1. Add RUSTSEC-2026-0387 to the ignore list in .cargo/audit.toml, with this
> reasoning and a pointer to this issue, so the scheduled audit can gate on
> everything else.
> 2. Keep this issue open (do not resolve it when the change for step 1 is
> merged) until one of the conditions below holds.
> Close this, removing the ignore, when either:
> - jsonwebtoken (or whatever provides ES256/ES384 verification) moves onto a
> crypto-bigint release that contains the fix; or
> - the gateway is changed to perform EC private-key operations in production
> code, in which case the analysis above no longer holds and this needs
> revisiting immediately.
> A longer-term option that removes both this advisory and RUSTSEC-2023-0071:
> switching jsonwebtoken to its aws_lc_rs provider drops the RustCrypto rsa and
> elliptic-curve stacks. It brings a C build dependency (aws-lc needs cmake) and
> new licenses to review, which SPARK-59552 deliberately avoided, so it is not
> proposed here.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
