v0.15.5

This is a minor release updating rustls to 0.23.46.

Security

This update addresses GHSA-h2v8-394m-p7vv, a security issue allowing a peer to exhaust memory with a malicious Brotli compressed certificate before authentication. This only affects builds with the cert_compression feature enabled (disabled by default). Clients connecting to a malicious server and servers requesting client certificates are affected and the attacker does not need a trusted certificate.

This update addresses GHSA-w44r-93j7-qv28, a security issue allowing an unauthenticated server response to influence the key exchange used by later connections sharing a rustls_client_config and server name. Clients preferring post-quantum key exchange could subsequently negotiate classical X25519 if the server accepts that key share instead of requesting a hybrid one. This removes post-quantum protection for those connections without bypassing authentication.

This update addresses GHSA-vp88-798v-h67f, a security issue affecting clients that enable Encrypted Client Hello with rustls_client_config_builder_enable_ech() and buffer application data with rustls_connection_write() before the handshake completes. If the server rejects ECH, that data could be sent to the authenticated outer server before the fatal alert, despite the handshake reporting failure. ECH GREASE is not affected.

This update also addresses GHSA-c8m5-c952-6cm4, which could expose session secrets when a custom client session store uses Rust's Debug formatting. This does not affect rustls-ffi users: the C API uses the built-in cache and does not expose these formatters.

What's Changed

• build(deps): bump rustls-platform-verifier from 0.7.0 to 0.7.1 by @dependabot[bot] in #684
• build(deps): bump taiki-e/install-action from 2.87.15 to 2.87.20 by @dependabot[bot] in #683
• build(deps): bump taiki-e/install-action from 2.87.20 to 2.87.22 by @dependabot[bot] in #685
• build(deps): bump libc from 0.2.189 to 0.2.190 by @dependabot[bot] in #686
• build(deps): bump tokio from 1.53.1 to 1.53.2 by @dependabot[bot] in #687
• build(deps): bump toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0 by @dependabot[bot] in #688
• build(deps): bump taiki-e/install-action from 2.87.22 to 2.87.27 by @dependabot[bot] in #689
• build(deps): bump serde_json from 1.0.151 to 1.0.152 by @dependabot[bot] in #691
• rustls-ffi 0.15.5 by @cpu in #690

Full Changelog: v0.15.4...v0.15.5