Thomas ZahnerApr 23

Just woke up to 5 vulnerability alerts (4 high severity) of the openSSL Rust crate. Now I'm even more thankful we've made the switch to rustls in lychee. I've only seen advantages so far. The transition was totally smooth, and now we have faster, more stable and apparently more secure TLS.

Thank you @djc, @ctz et al. for this amazing piece of software!

#rust #openssl #rustls

Show threadFabio ValentiniApr 23
@thomas_zahner it looks like they were now all downgraded to "medium" or "low" severity? (still bad, but I guess *less* bad?)
Show threadThomas ZahnerApr 27

@decathorpe Hmm I still see them as high severity, but not sure how easy it is to exploit them in the real world.

As far as I understand many of the vulnerabilities are caused by FFI and incorrect pointer logic, after all the library is just bindings for OpenSSL. rustls in contrast is a full Rust implementation reducing the need for unsafe code and raw pointers, which reduces the probability of such bugs greatly.

Show threadFabio Valentini

@thomas_zahner by "downgraded from high to medium" I meant that the original screenshot you included from the GitHub UI shows them as "high" but now that same page lists them as "medium":

https://github.com/rust-openssl/rust-openssl/security

Build software better, together

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

GitHub
Apr 29 at 12:16pmWeb
Show threadThomas ZahnerApr 29
@decathorpe huh interesting. They might weigh the criteria differently? Until now I thought they would use plain CVSS
Show threadFabio ValentiniApr 29

@thomas_zahner I'm not sure what you mean?

they were classified as "high" initially but are "medium" now. so it looks like the severity for those GHSAs was just adjusted down after you made your screenshot.

Show threadThomas ZahnerApr 29
@decathorpe ah yes, I see, thank you. I just pointed out that I thought GitHub would simply show the CVSS criticality until now. But that's not the case. So I learned something today :)