From 0220c3170690ac38d9bb14be82fbb112a6aff9f8 Mon Sep 17 00:00:00 2001 From: Daniel McCarney Date: Mon, 26 Oct 2026 13:06:27 -0400 Subject: [PATCH] Cargo: v0.15.6 -> v0.15.7 --- CHANGELOG.md | 26 ++++++++++++++++++++++++++ Cargo.lock | 2 +- librustls/Cargo.toml | 2 +- librustls/cbindgen.toml | 2 +- librustls/src/rustls.h | 2 +- 5 files changed, 30 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c4860579..dcbea7e7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,31 @@ # Changelog +## 0.15.7 (2026-10-26) + +This is a minor release, fixing one security issue and improving API +documentation. + +### Security + +This update addresses +[GHSA-rc3f-4j82-cmrg](https://github.com/rustls/rustls-ffi/security/advisories/GHSA-rc3f-4j82-cmrg), +a security issue affecting `rustls_client_connection_new()` and +`rustls_client_connection_new_alpn()`. These functions retained a reference to +the caller's `server_name` buffer after returning, rather than copying it. The +API documentation did not require the buffer to outlive the call and as a result +if the caller freed or reused the buffer, later TLS processing read freed +memory. + +Clients that free or reuse the `server_name` buffer after the constructor +returns are affected. This is most likely for language bindings that pass +temporary strings. Callers that keep the `server_name` buffer alive for the +lifetime of the `rustls_client_config` are not affected. + +Versions 0.12.0 through 0.15.6 are affected. Version 0.15.7+ changed these APIs +to copy the input buffer. Additionally our FFI helpers have been updated to +prevent this class of issue in the future, and documentation throughout has been +improved to clarify lifetime/ownership of inputs/returns. + ## 0.15.6 (2026-10-20) This is a minor release, notably updating `rustls-webpki` so it includes diff --git a/Cargo.lock b/Cargo.lock index 2a42584b..bdf45f01 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1112,7 +1112,7 @@ dependencies = [ [[package]] name = "rustls-ffi" -version = "0.15.6" +version = "0.15.7" dependencies = [ "libc", "log", diff --git a/librustls/Cargo.toml b/librustls/Cargo.toml index 4f716bdb..48c66a59 100644 --- a/librustls/Cargo.toml +++ b/librustls/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "rustls-ffi" # Keep in sync with defines in cbindgen.toml -version = "0.15.6" +version = "0.15.7" license = "Apache-2.0 OR ISC OR MIT" readme = "../README-crates.io.md" description = "Rustls bindings for non-Rust languages" diff --git a/librustls/cbindgen.toml b/librustls/cbindgen.toml index 7f22e48c..92fd246a 100644 --- a/librustls/cbindgen.toml +++ b/librustls/cbindgen.toml @@ -5,7 +5,7 @@ after_includes = """ #define RUSTLS_VERSION_MAJOR 0 #define RUSTLS_VERSION_MINOR 15 -#define RUSTLS_VERSION_PATCH 6 +#define RUSTLS_VERSION_PATCH 7 /** * This gives each version part 8 bits, and leaves the 8 least significant bits diff --git a/librustls/src/rustls.h b/librustls/src/rustls.h index 9715376a..6e68067a 100644 --- a/librustls/src/rustls.h +++ b/librustls/src/rustls.h @@ -9,7 +9,7 @@ #define RUSTLS_VERSION_MAJOR 0 #define RUSTLS_VERSION_MINOR 15 -#define RUSTLS_VERSION_PATCH 6 +#define RUSTLS_VERSION_PATCH 7 /** * This gives each version part 8 bits, and leaves the 8 least significant bits