From 75ed12da3284b00701ab60eb1a6abc9bb8d77a57 Mon Sep 17 00:00:00 2001 From: Daniel McCarney Date: Mon, 26 Oct 2026 13:55:33 -0400 Subject: [PATCH] add rustls-ffi GHSA-rc3f-4j82-cmrg advisory --- crates/rustls-ffi/RUSTSEC-0000-0000.md | 30 ++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 crates/rustls-ffi/RUSTSEC-0000-0000.md diff --git a/crates/rustls-ffi/RUSTSEC-0000-0000.md b/crates/rustls-ffi/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..48fca4933 --- /dev/null +++ b/crates/rustls-ffi/RUSTSEC-0000-0000.md @@ -0,0 +1,30 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "rustls-ffi" +date = "2026-10-26" +url = "https://github.com/rustls/rustls-ffi/releases/tag/v/0.15.7" +categories = ["memory-corruption"] +aliases = ["GHSA-rc3f-4j82-cmrg"] + +[versions] +patched = [">= 0.15.7"] +unaffected = ["< 0.12.0"] +``` + +# Use-after-free of caller-owned server name in client connection constructors + +In rustls-ffi 0.12.0 through 0.15.6, `rustls_client_connection_new()` and +`rustls_client_connection_new_alpn()` retained a reference to the caller's +`server_name` buffer after returning, rather than copying it. The API +documentation did not require the buffer to outlive the call and as a result +if the caller freed or reused the buffer, later TLS processing read freed +memory. + +Clients that free or reuse the `server_name` buffer after the constructor +returns are affected. This is most likely for language bindings that pass +temporary strings. Callers that keep the `server_name` buffer alive for the +lifetime of the `rustls_client_config` are not affected. + +Versions 0.12.0 through 0.15.6 are affected. Version 0.15.7+ changed these APIs +to copy the input buffer.