chore(deps): update rust crate pgp to 0.19 [security]#351
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update rust crate pgp to 0.19 [security]#351renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
renovate
bot
force-pushed
the
renovate/crate-pgp-vulnerability
branch
from
8202d0b to
7cf89ac
Compare
renovate
bot
force-pushed
the
renovate/crate-pgp-vulnerability
branch
from
7cf89ac to
942b193
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.16→0.19GitHub Vulnerability Alerts
GHSA-7587-4wv6-m68m
Summary
It was possible to trigger an unhandled edge case in the Rust Crypto rsa crate through rPGP packet parsing functionality, and crash the process that runs rPGP. This problem has been patched in a new rsa version. The new release of rPGP ensures a patched version of the rsa crate is in use, which prevents this issue.
Details
While parsing a special RSA secret key packet, rPGP calls the rsa crate with the provided key. On vulnerable versions, this results in a Rust "panic" during key construction. Note that an attacker can trigger this situation even in places where applications don't expect to handle foreign key material, for example while attempting to receive a message.
For more information on the rsa crate vulnerability, see GHSA-9c48-w39g-hm26 and https://github.com/RustCrypto/RSA/pull/624.
In rPGP, this has been fixed via https://github.com/rpgp/rpgp/pull/698.
Impact
This issue impacts availability (i.e. applications can crash).
Affected rPGP versions: rPGP 0.16.0-alpha.0 to 0.18.0
Vulnerable rsa versions: all before version 0.9.10
Workaround
The issue depends on the combination of affected rPGP and rsa versions. Users of affected rPGP versions can pin the patched rsa 0.9.10 via a cargo lockfile to mitigate the issue.
Attribution
Discovered by Christian Reitter from Radically Open Security during a security review for Proton AG.
GHSA-8h58-w33p-wq3g
Summary
Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.
rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).
Impact
An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.
Attribution
Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.
GHSA-c7ph-f7jm-xv4w
Summary
For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.
Details
When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.
Impact
While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.
Attribution
Discovered internally in the course of rPGP development work.
Release Notes
rpgp/rpgp (pgp)
v0.19.0Compare Source
⛰️ Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
🧪 Testing
⚙️ Miscellaneous Tasks
v0.18.0Compare Source
⛰️ Features
🐛 Bug Fixes
🚜 Refactor
\rcharacters (#650) - (410c844)📚 Documentation
⚙️ Miscellaneous Tasks
Cleanup
v0.17.0Compare Source
⛰️ Features
signature::Signercompatibility wrappers - (854387a)Fingerprint(#600) - (e0357f2)🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
Adapter
Cleanup
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.