RUSTSEC-2026-0346: `Debug` impls for client session values expose TLS secrets · Issue #16 · aaronkwhite/linear-cli · GitHub
Skip to content

RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets #16

Open

Description

@github-actions

Debug impls for client session values expose TLS secrets

Details
Package rustls
Version 0.23.37
URL rustls/rustls#3299
Date 2026-10-14
Patched versions >=0.23.46
Unaffected versions <0.21.0

The Debug implementations of Tls12ClientSessionValue and
Tls13ClientSessionValue were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with
Debug (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and
is not affected.

See advisory page for additional details.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions