Repository navigation
fix(deps): ctutils 0.4.2 -> 0.4.5 for RUSTSEC-2026-0385 - #1155
Merged
Merged
Conversation
RUSTSEC-2026-0385: ctutils 0.4.2 generates masks and compares u128 values in non-constant time; fixed in 0.4.4. ctutils is transitive, through digest 0.11 into hmac and pbkdf2, and sat at 0.4.2 in four tracked lockfiles. CI's security-audit step fails on it for main and every PR. Cargo.lock and dsm_client/deterministic_state_machine/Cargo.lock: `cargo update -p ctutils --precise 0.4.5`, which changed exactly the entry's version and checksum. The two workspace-excluded anchor crates (dsm-anchor-hw-verifier, dsm-android-anchor) cannot resolve their sibling libtropic-rs checkout from a nested worktree, so their identical entry got the same two lines; ctutils 0.4.5 needs cmov ^0.5.3, and all four lockfiles hold cmov 0.5.4. ci/audit_every_lockfile.sh: 9 lockfiles, no vulnerabilities (main's Cargo.lock still reports RUSTSEC-2026-0385). cargo check --locked --workspace --all-targets in both workspaces exit 0; dsm crypto tests 156/0 and key_schedule/identity 27/0 in release; make lint exit 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
RUSTSEC-2026-0385:
ctutils0.4.2 generates masks and comparesu128values in non-constant time. Version 0.4.4 fixes it.ctutilsis a transitive dependency: it comes in throughdigest0.11 intohmacandpbkdf2, and sat at 0.4.2 in four tracked lockfiles. CI's "Security audit (every tracked Cargo.lock)" step in Rust gates now fails on it formainand every open PR, for example #1151.What
ctutils0.4.2 → 0.4.5, the newest version, not yanked. The change is two lines (version and checksum) in each of four lockfiles; nothing else moves.Cargo.lockanddsm_client/deterministic_state_machine/Cargo.lock: updated withcargo update -p ctutils --precise 0.4.5.crates/dsm-anchor-hw-verifier/Cargo.lockandcrates/dsm-android-anchor/Cargo.lock: these crates are outside the workspace and resolve a siblinglibtropic-rscheckout, which cargo can't reach from a nested worktree. Theirctutilsentry was byte-identical, so they received the same two-line change.cmov ^0.5.3, and all four lockfiles holdcmov0.5.4. CI's "Embedded (no_std + excluded anchor crates)" job builds the two anchor lockfiles with--locked.Verification
bash ci/audit_every_lockfile.sh: 9 lockfiles, no vulnerabilities. Control:main'sCargo.lockstill reports RUSTSEC-2026-0385.cargo check --locked --workspace --all-targets: exit 0 in both workspaces.dsmcrypto tests: 156 passed, 0 failed (release);key_schedule/identity: 27 passed, 0 failed (release).make lint: exit 0.🤖 Generated with Claude Code