gru/mikrotik-backup
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
Mateusz Gruszczyński committed 2026-10-28 09:16:54 +01:00
commit 32a7ba8e8f
168 files changed
+123856
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/dependency-security.md
+112
View File
@@ -0,0 +1,112 @@
# Dependency review — release 0.0.1
The audit documented here was performed on **27 October 2026 for source revision 2**
of release 0.0.1. Its scope was `Cargo.lock`, known public advisories, and the C SSH
library bundled through `libssh2-sys`. Revision 3 additionally verified the provenance
of local Swagger UI assets. These historical checks are not a claim that a new
advisory scan has been run for revision 4; see [the validation report](validation.md).
A scanner result is limited to its advisory database and examined versions and does
not establish the absence of every vulnerability.
## RustSec and dependency changes
The recorded run used **cargo-audit 0.22.2** and a RustSec database containing
**1,380 advisories**, at commit `99670cfc0bc574433034b75876a4b791ccaa2efb`, last updated
`2026-10-27T11:02:42+01:00`. The audited dependency set produced **0 reported
vulnerabilities and 0 warnings**. The complete JSON result is preserved in
[`dependency-audit.json`](dependency-audit.json); the lockfile identity is recorded in
[`dependency-audit-metadata.json`](dependency-audit-metadata.json).
The original final revision 2 scan JSON is unchanged. Its `last-commit` and
`last-updated` fields contain the database revision and timestamp above. Metadata
records the audit time, tool version, report SHA-256, and the audited `Cargo.lock`
SHA-256: `341839930e9b231b548dbd1dbbc8e497531ff9c4903b3cf07722f3d9f024e2d8`.
To repeat the audit:
```sh
cargo audit --file Cargo.lock --json
```
No `--ignore` exceptions were used. The scan did not modify the manifest or lockfile.
| Dependency | Release version | Reason |
| --- | --- | --- |
| `zip` | 9.1.2 | Replaced 2.6.1, affected by RUSTSEC-2026-0367, -0368, and -0369. The application creates archives rather than invoking the affected extraction functions, but the release still uses the corrected library. |
| `jsonwebtoken` | 11.1.0 with `aws_lc_rs` | Replaced 9.3.1, affected by CVE-2026-25537. Corrected validation rejects invalid date types; additional application tests cover `exp`, `nbf`, algorithm, signature, and compatibility with Python HS256 tokens. |
| `tokio` | 1.54.1 | Includes fixes for RUSTSEC-2026-0384 and RUSTSEC-2026-0386. |
| `rustls-webpki` | 0.103.16 | Uses the corrected version assessed by the recorded RustSec database. |
| `ssh2` / `libssh2-sys` | 0.9.6 / locally patched 0.3.3 | Adds missing fixes to the bundled C code, described below. |
Sources: [RustSec 0367](https://rustsec.org/advisories/RUSTSEC-2026-0367.html),
[0368](https://rustsec.org/advisories/RUSTSEC-2026-0368.html),
[0369](https://rustsec.org/advisories/RUSTSEC-2026-0369.html),
[jsonwebtoken maintainer advisory](https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc),
[RustSec 0384](https://rustsec.org/advisories/RUSTSEC-2026-0384.html), and
[0386](https://rustsec.org/advisories/RUSTSEC-2026-0386.html).
## Local API documentation assets — revision 3
Swagger UI comes from the pinned official `swagger-ui-dist 5.34.0` package. The
archive's integrity was checked against its published npm SHA-512 value. The retained
files' SHA-256 values and source are recorded in `vendor/swagger-ui/PROVENANCE.json`.
The license, NOTICE, and embedded-library license information are retained. Neither
the application nor the browser fetches these assets from a CDN.
The documentation loads only its local specification. The online validator,
query-string configuration, and persistent authorization are disabled. A same-origin
request interceptor and CSP restrict requests. The RustSec audit above covers Rust
dependencies; it is not a JavaScript security scan of this package. See
[API documentation integration](api-documentation.md) for provenance and behavior.
Revision 4 changes how these checked-in files are embedded, without replacing the
vendored Swagger UI files.
## Bundled libssh2 fixes
A current crate version alone was insufficient. Published `libssh2-sys 0.3.3`
contained a libssh2 1.11.1 base with four earlier backports, but omitted later fixes.
Specific functions were compared against upstream libssh2 patches. This confirmed
missing AES-GCM bounds checks, short ETM packet checks, and the other corrections
listed below. The application uses the affected encryption negotiation and SFTP
code, so the release includes code fixes rather than only documenting the findings.
`vendor/libssh2-sys` contains the original sources needed for compilation, original
licenses, preserved upstream patches, their SHA-256 values, and a patch reproducing
the changes. Cargo uses this local dependency. Compilation always uses the patched
code; it does not silently substitute a system libssh2.
| Advisory | Fix scope | Upstream source |
| --- | --- | --- |
| CVE-2026-7598 | Username and authentication data lengths | [256d04b60d80](https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1) |
| CVE-2026-66032 | Double-free of an SFTP file-open response | [5e4776146552](https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0) |
| CVE-2026-66033 | AES-GCM buffer bounds and release-build length calculation | [a2ed82d40964](https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6) |
| CVE-2026-66034 | Comment length in a publickey subsystem response | [a13bb6c773f0](https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9) |
| CVE-2026-66035 | Minimum ETM packet length before decryption | [42e33d81577e](https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4) |
| CVE-2026-58050 | Publickey attribute limit before allocation | [34497525929b](https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12) |
| CVE-2026-58051 | Publickey list entry initialization before cleanup | [a9758da45a52](https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a) |
Two upstream follow-up fixes for freeing partially created attributes and initializing
the list tail are also included. Full commit IDs, private-function name adaptations,
and reproduction instructions are in
[`PROVENANCE.md`](../vendor/libssh2-sys/PROVENANCE.md). Distribution notices
[USN-8722-1](https://ubuntu.com/security/notices/USN-8722-1) and
[USN-8799-1](https://ubuntu.com/security/notices/USN-8799-1) independently describe
these advisory families.
## Verification and limits
The patch was reproduced on a fresh copy of the published crate; all seven modified
files matched the bundled code byte for byte. `vendor/libssh2-sys/SHA256SUMS` supports
integrity checks of the included files.
A separate C regression program in the source tree invokes the same static library
with invalid AES-GCM lengths and overflowing username lengths. Its execution
instructions are in `PROVENANCE.md`. Actual build, Rust-test, C-test, and SSH-session
results are recorded by revision in [the validation report](validation.md).
RustSec checks Rust dependency identities and versions. It does not replace C code
review, container image scanning, or updates to system OpenSSL and zlib libraries.
Local SSH-server tests exercise the real protocol, but do not reproduce every attack
family or establish compatibility with every physical MikroTik model. Dependency
updates require a new scan, relevant tests, and comparison of these backports with
the newer upstream release.