Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: < 0.23.46
Patched in 0.23.46
Vulnerable: >= 0.24.0-dev.1, < 0.24.0-dev.2
Patched in 0.24.0-dev.2
Details
Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.
Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit key-material redaction policy.
Custom ClientSessionStore implementations could leak secret data by using the provided Tls12ClientSessionValue or Tls13ClientSessionValue in a way that triggers its implementation of the Debug trait.
Such store implementations could leak the master secret for the TLS connection.
Thanks to OpenAI [email protected] for the disclosure.
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.