Here's what I found while triaging this issue:

Confirmed: the current dependency graph still includes the vulnerable legacy rustls-webpki entry, and #9918 is the linked fix for this tracking issue.

Maintainer details

I concluded that security dependency tracking issue is confirmed: aws-sdk-sts currently keeps a vulnerable legacy rustls-webpki version in the lockfile, and PR #9918 is the targeted fix..

Triage summary

Confirmed as an actionable security dependency fix. The current manifest declares aws-sdk-sts = "1" in app/Cargo.toml, and the checked-in Cargo.lock still resolves the legacy TLS chain rustls 0.21.12 -> rustls-webpki 0.101.7 in addition to the newer rustls-webpki 0.103.13.

The linked PR #9918 is aligned with the likely root cause: aws-sdk-sts default features keep the legacy rustls backend enabled, so disabling default features while explicitly retaining the modern HTTPS client/Tokio runtime should remove the vulnerable legacy dependency path.

Duplicate scan: searched all open issues plus recently closed issues for matching aws-sdk-sts, rustls-webpki, rustls, dependency-audit, and security-fix reports. Related security/dependency issues exist, but fewer than two match this same package and vulnerability chain, so this should not be marked duplicate.

This is my automated analysis and may be incorrect. A maintainer will verify the details.

Update aws-sdk-sts to resolve rustls-webpki vulnerabilities #10070

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions