Live › vulnerability › GHSA-c8m5-c952-6cm4
Go to dashboardFormatting a Rustls client session value with Debug prints its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can leak keys to anyone who reads the logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:10 UTC. All times on this page are UTC.
Only applications that implement a custom ClientSessionStore and print its session values with Debug or log them. Ordinary connections and the built-in cache keep secrets redacted, so most rustls users are not exposed. Teams running custom session stores with logging should upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| rustls | cargo | < 0.23.46 | 0.23.46 |
| rustls | cargo | >= 0.24.0-dev.1, < 0.24.0-dev.2 | 0.24.0-dev.2 |
cargo tree -i rustls and note the resolved versionClientSessionStore implementation that logs or Debug-formats Tls12ClientSessionValue or Tls13ClientSessionValue0.23.46 or later on the 0.23 line0.24.0-dev.2 or later if you use the 0.24 dev lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.
Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit key-material redaction policy.
Custom ClientSessionStore implementations could leak secret data by using the provided Tls12ClientSessionValue or Tls13ClientSessionValue in a way that triggers its implementation of the Debug trait.
Such store implementations could leak the master secret for the TLS connection.
Thanks to OpenAI [email protected] for the disclosure.
This page as .md · .json · in your agent: get_signal("GHSA-c8m5-c952-6cm4")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.