v0.7.6 - #1365

This advisory covers issues fixed in v0.7.6:

RustCrypto/crypto-bigint#1365

This advisory covers issues fixed in v0.7.6:

RustCrypto/crypto-bigint#1365

…0.5.5 时序可变性族(无范围内补丁)

supply-chain job 红(run 于 e0c57e6 push):crypto-bigint 0.5.5 非常数时间运算时序可变性(2026-10-24 新公告,RustCrypto/crypto-bigint#1365),解法=升 >=0.7.6 跨大版本,而依赖方 aws-sigv4 1.5.1 / elliptic-curve 0.13.8 均 pin ^0.5——**升级通道不可用,进豁免清单**(audit.toml 头部原则:能 update 的不进清单;本条属「无 patched 可锁」场景,与 zip 0367-0369 同类)。暴露面:纯传递依赖零直接调用,AWS SigV4/P-256 均在成熟库内部,无自建常数时间面。解禁条件=依赖方发布支持 0.7 的版本并升级。与落地内容(e0c57e6 纯 docs)无关,纯 advisory-db 漂移。Policy-ack: jeffkit 2026-10-19

crypto-bigint 0.7.5 carries RUSTSEC-2026-0387: timing variability in
operations meant to be constant-time (RustCrypto/crypto-bigint#1365), on
the paths that rely on it for constant-time arithmetic -- PKINIT's
Diffie-Hellman, RSA and ECDSA, and SPAKE's curves. Update it to 0.7.6,
which fixes them, in the root and fuzz lockfiles; the transitive ctutils
constant-time helper moves 0.4.4 -> 0.4.5 with it. The dependency
requirement stays "0.7", so there is no manifest, API or MSRV change.

Move the cargo-vet exemptions for both crates to the new versions; they
stay exempted pending the 1.2 supply-chain audit. Record a Security
CHANGELOG bullet.

```
Crate:     crypto-bigint
Version:   0.5.5
Title:     Multiple timing variability issues in operations intended to be constant-time
Date:      2026-10-23
ID:        RUSTSEC-2026-0387
URL:       RustCrypto/crypto-bigint#1365
Solution:  Upgrade to >=0.7.6

Crate:     h2
Version:   0.4.11
Title:     h2 unbounded empty DATA frames
Date:      2026-08-17
ID:        RUSTSEC-2026-0258
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0258
Solution:  Upgrade to >=0.4.16

Crate:     quinn-proto
Version:   0.11.15
Title:     Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
Date:      2026-08-17
ID:        RUSTSEC-2026-0342
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0342
Solution:  Upgrade to >=0.11.17

Crate:     quinn-proto
Version:   0.11.15
Title:     Unbounded growth of pending connection ID retirements in quinn-proto
Date:      2026-08-17
ID:        RUSTSEC-2026-0339
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0339
Solution:  Upgrade to >=0.11.17

Crate:     quinn-proto
Version:   0.11.15
Title:     Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
Date:      2026-09-14
ID:        RUSTSEC-2026-0338
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0338
Solution:  Upgrade to >=0.11.18

Crate:     quinn-proto
Version:   0.11.15
Title:     Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
Date:      2026-09-14
ID:        RUSTSEC-2026-0340
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0340
Severity:  7.5 (high)
Solution:  Upgrade to >=0.11.18

Crate:     quinn-proto
Version:   0.11.15
Title:     Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
Date:      2026-08-17
ID:        RUSTSEC-2026-0341
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0341
Severity:  7.5 (high)
Solution:  Upgrade to >=0.11.17

Crate:     rustls
Version:   0.23.28
Title:     `Debug` impls for client session values expose TLS secrets
Date:      2026-10-14
ID:        RUSTSEC-2026-0346
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0346
Severity:  4 (medium)
Solution:  Upgrade to >=0.23.46

Crate:     rustls
Version:   0.23.28
Title:     TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Date:      2026-09-14
ID:        RUSTSEC-2026-0285
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0285
Severity:  5.3 (medium)
Solution:  Upgrade to >=0.23.45

Crate:     rustls
Version:   0.23.28
Title:     Brotli certificate decompression can allocate up to 1 GiB before authentication
Date:      2026-10-14
ID:        RUSTSEC-2026-0348
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0348
Severity:  3.7 (low)
Solution:  Upgrade to >=0.23.46

Crate:     rustls
Version:   0.23.28
Title:     Unauthenticated ServerHello can downgrade later connections to classical key exchange
Date:      2026-10-14
ID:        RUSTSEC-2026-0349
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0349
Severity:  3.7 (low)
Solution:  Upgrade to >=0.23.46

Crate:     rustls-webpki
Version:   0.103.13
Title:     Certificate verification may accept distrusted intermediates
Date:      2026-10-20
ID:        RUSTSEC-2026-0382
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0382
Solution:  Upgrade to >=0.103.16, <0.104.0-alpha.1 OR >=0.104.0-alpha.8

Crate:     basic-toml
Version:   0.1.10
Warning:   unmaintained
Title:     `basic-toml` is unmaintained
Date:      2026-09-26
ID:        RUSTSEC-2026-0374
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0374

Crate:     unsafe-libyaml
Version:   0.2.11
Warning:   unmaintained
Title:     unsafe-libyaml is unmaintained
Date:      2024-03-25
ID:        RUSTSEC-2024-0449
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0449

Crate:     tokio
Version:   1.44.2
Warning:   unsound
Title:     `AsyncFd::new` and related constructors violate I/O safety
Date:      2026-10-13
ID:        RUSTSEC-2026-0386
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0386
```

tpmd 0.1.1 (security)

This patch updates the dependencies tpmd carries. It contains no
functional or wire-protocol change: the same daemon, with the same
keys, on the same binary interface.

## Security

- **RUSTSEC-2026-0387** — Multiple timing variability issues in operations intended to be constant-time ([advisory](RustCrypto/crypto-bigint#1365)).
  `crypto-bigint` 0.7.5 → 0.7.10.
- **RUSTSEC-2026-0385** — Non-constant-time mask generation and `u128` comparisons ([advisory](RustCrypto/utils#1569)).
  `ctutils` 0.4.3 → 0.4.8.

## Upgrade

```sh
sudo apt-get update
sudo apt-get install --only-upgrade tpmd
```

The Cloudsmith repository and the Forgejo mirror carry the same version,
so a machine configured for either upgrades the same way. Keys live in
`/var/lib/tpmd` and are untouched by an upgrade.

Co-authored-by: tpmd security bot <[email protected]>

This switches us from hickory-resolver 0.24 to 0.26, with some naming changes.

Upgrades from Rust 1.91.0 to 1.99.1, which is where the unused imports deletions came from.

Also ran a general `cargo update`.

Takes us from

```
error: 14 vulnerabilities found!
warning: 18 allowed warnings found
```

to

```
error: 2 vulnerabilities found!
warning: 7 allowed warnings found
```

The remaining two are

```
Crate:     crypto-bigint
Version:   0.5.5
Title:     Multiple timing variability issues in operations intended to be constant-time
Date:      2026-10-23
ID:        RUSTSEC-2026-0387
URL:       RustCrypto/crypto-bigint#1365
Solution:  Upgrade to >=0.7.6

Crate:     rsa
Version:   0.9.10
Title:     Marvin Attack: potential key recovery through timing sidechannels
Date:      2023-11-22
ID:        RUSTSEC-2023-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity:  5.9 (medium)
Solution:  No fixed upgrade is available!
```

Where the first is pinned by jsonwebtoken and jacquard-common and the second has no fix version.

… residual risk (#70)

## Summary


[RUSTSEC-2026-0387](RustCrypto/crypto-bigint#1365):
several `crypto-bigint` operations meant to be constant-time can take
secret-dependent branches, depending on compiler and CPU. It's patched
only in `crypto-bigint` ≥ 0.7.6, and **neither copy in our tree can
reach that**:

| Version | Path | Key types | Why it can't be updated |
|---|---|---|---|
| 0.5.5 | `ssh-key` 0.6.7 → `p256`/`p384`/`p521` → `elliptic-curve` 0.13
| **ECDSA**: keygen, SSHSIG signing, agent-daemon signing | The 0.5 line
has no fix; needs `ssh-key` 0.7 |
| 0.7.0-rc.28 | `russh` 0.60.3 → `rsa` 0.10.0-rc.16 → `crypto-primes` |
**RSA** | russh pins the `rsa` prerelease |

This PR adds a `deny.toml` ignore with the full rationale, a
residual-risk section in `docs/security.md` (same structure as the
RUSTSEC-2023-0071 Marvin entry), and a CHANGELOG `Security` entry.

**Why the risk is accepted for now:**
1. **Ed25519, the default key type, is unaffected.**
2. **Transport crypto is unaffected:** key exchange and session ciphers
run on russh's `aws-lc-rs` backend.
3. **The exposure is a local side channel** in secret-key arithmetic on
the signing machine; network jitter hides it from remote observers.
Unlike the Marvin case, the agent daemon can sign once per push, so a
co-located attacker can collect many samples. The docs say so plainly
and tell ECDSA/RSA users on shared machines to switch to Ed25519.
4. **No safe upgrade exists** in the reachable dependency tree.

**Lift when:** `ssh-key` 0.7 (crypto-bigint ≥ 0.7.6) and a russh release
with a patched `rsa`/`crypto-bigint` are adopted. The ignore is reviewed
at every release, per `deny.toml` policy.

`cargo-deny` goes fully green only together with #69, which fixes
RUSTSEC-2026-0385/0386.

## Test plan

- [x] `cargo deny --all-features check` locally: RUSTSEC-2026-0387 no
longer reported; bans, licenses and sources ok. The only remaining
failures are 0385/0386, fixed by #69.
- [x] Docs-only otherwise; CRLF line endings of `deny.toml` and
`docs/security.md` preserved (additions only)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <[email protected]>