From 448ae6bf0697e8ea4fd85508bcd35b9ad8439f86 Mon Sep 17 00:00:00 2001 From: Lucas Pimentel Date: Thu, 15 Oct 2026 13:31:50 -0400 Subject: [PATCH 1/3] Ignore new rustls advisories pending FIPS-certified aws-lc-rs cargo-audit fails on RUSTSEC-2026-0346/0348/0349, which are fixed in rustls >= 0.23.46. Every rustls version from 0.23.45 onward requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, still pending FIPS 140-3 certification, so the pinned versions cannot be bumped yet. Each ignored advisory is practically mitigated: the brotli feature is disabled, 0349 only weakens post-quantum confidentiality, and 0346 requires a custom session store that logs Debug output. Ignores are commented with justifications and a removal note. --- .cargo/audit.toml | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 8e88df8d..15e25c54 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -1,6 +1,19 @@ -# RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires -# aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 -# certification. Remove this ignore once a FIPS-certified aws-lc-rs is -# available. +# These rustls advisories are fixed in rustls >= 0.23.46, but every version +# from 0.23.45 onward requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS +# 4.x, pending FIPS 140-3 certification. Remove these ignores once a +# FIPS-certified aws-lc-rs is available. +# +# RUSTSEC-2026-0285: yanked rustls release, superseded by 0.23.45. +# RUSTSEC-2026-0348: Brotli cert-decompression DoS; the brotli feature is not +# enabled (default-features = false in crates/datadog-fips). +# RUSTSEC-2026-0349: ServerHello downgrade loses post-quantum confidentiality; +# no key compromise or auth bypass, server policy dependent. +# RUSTSEC-2026-0346: derived Debug impls can expose TLS session secrets, but +# only for custom ClientSessionStore implementations that log them. [advisories] -ignore = ["RUSTSEC-2026-0285"] +ignore = [ + "RUSTSEC-2026-0285", + "RUSTSEC-2026-0348", + "RUSTSEC-2026-0349", + "RUSTSEC-2026-0346", +] From 50de371e7bc1473210fbf0d8be44118411788f28 Mon Sep 17 00:00:00 2001 From: Lucas Pimentel Date: Thu, 15 Oct 2026 13:59:26 -0400 Subject: [PATCH 2/3] Update .cargo/audit.toml Co-authored-by: Yiming Luo <10097700+lym953@users.noreply.github.com> --- .cargo/audit.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 15e25c54..f50099fc 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -3,7 +3,8 @@ # 4.x, pending FIPS 140-3 certification. Remove these ignores once a # FIPS-certified aws-lc-rs is available. # -# RUSTSEC-2026-0285: yanked rustls release, superseded by 0.23.45. +# RUSTSEC-2026-0285: TLS 1.3 handshake messages accepted across encryption +# level boundaries. # RUSTSEC-2026-0348: Brotli cert-decompression DoS; the brotli feature is not # enabled (default-features = false in crates/datadog-fips). # RUSTSEC-2026-0349: ServerHello downgrade loses post-quantum confidentiality; From 2612ebd738306ecc606f3853e79e192d43cdb2c0 Mon Sep 17 00:00:00 2001 From: Lucas Pimentel Date: Thu, 15 Oct 2026 14:00:22 -0400 Subject: [PATCH 3/3] Update .cargo/audit.toml Co-authored-by: Yiming Luo <10097700+lym953@users.noreply.github.com> --- .cargo/audit.toml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index f50099fc..abd83de9 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -7,8 +7,10 @@ # level boundaries. # RUSTSEC-2026-0348: Brotli cert-decompression DoS; the brotli feature is not # enabled (default-features = false in crates/datadog-fips). -# RUSTSEC-2026-0349: ServerHello downgrade loses post-quantum confidentiality; -# no key compromise or auth bypass, server policy dependent. +# RUSTSEC-2026-0349: ServerHello downgrade loses post-quantum confidentiality. +# The FIPS provider puts X25519MLKEM768 after P-256 and P-384, so the client +# sends a classical key share unless the server asks for the hybrid group +# with a HelloRetryRequest, and the advisory excludes those servers. # RUSTSEC-2026-0346: derived Debug impls can expose TLS session secrets, but # only for custom ClientSessionStore implementations that log them. [advisories]