https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 20:50:57 +0000 https://db.gcve.eu/vuln/ghsa-c8m5-c952-6cm4 <p><strong>Affected:</strong> crates.io: rustls</p> <p>### Summary</p> <p>Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.</p> <p>### Details</p> <p>Derived formatters traverse the session&#39;s secret-bearing fields. This conflicts with the project&#39;s explicit [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).</p> <p>### Proof of concept</p> <p>Custom `ClientSessionStore` implementations could leak secret data by using the provided `Tls12ClientSessionValue` or `Tls13ClientSessionValue` in a way that triggers its implementation of the `Debug` trait.</p> <p>### Impact</p> <p>Such store implementations could leak the master secret for the TLS connection.</p> <p>### Acknowledgement Thanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.</p> <p><strong>Affected:</strong> crates.io: rustls</p> <p>### Summary</p> <p>Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.</p> <p>### Details</p> <p>Derived formatters traverse the session&#39;s secret-bearing fields. This conflicts with the project&#39;s explicit [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).</p> <p>### Proof of concept</p> <p>Custom `ClientSessionStore` implementations could leak secret data by using the provided `Tls12ClientSessionValue` or `Tls13ClientSessionValue` in a way that triggers its implementation of the `Debug` trait.</p> <p>### Impact</p> <p>Such store implementations could leak the master secret for the TLS connection.</p> <p>### Acknowledgement Thanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.</p> https://db.gcve.eu/vuln/ghsa-c8m5-c952-6cm4