113 lines
7.2 KiB
Markdown
113 lines
7.2 KiB
Markdown
# Dependency review — release 0.0.1
|
|
|
|
The audit documented here was performed on **27 October 2026 for source revision 2**
|
|
of release 0.0.1. Its scope was `Cargo.lock`, known public advisories, and the C SSH
|
|
library bundled through `libssh2-sys`. Revision 3 additionally verified the provenance
|
|
of local Swagger UI assets. These historical checks are not a claim that a new
|
|
advisory scan has been run for revision 4; see [the validation report](validation.md).
|
|
A scanner result is limited to its advisory database and examined versions and does
|
|
not establish the absence of every vulnerability.
|
|
|
|
## RustSec and dependency changes
|
|
|
|
The recorded run used **cargo-audit 0.22.2** and a RustSec database containing
|
|
**1,380 advisories**, at commit `99670cfc0bc574433034b75876a4b791ccaa2efb`, last updated
|
|
`2026-10-27T11:02:42+01:00`. The audited dependency set produced **0 reported
|
|
vulnerabilities and 0 warnings**. The complete JSON result is preserved in
|
|
[`dependency-audit.json`](dependency-audit.json); the lockfile identity is recorded in
|
|
[`dependency-audit-metadata.json`](dependency-audit-metadata.json).
|
|
|
|
The original final revision 2 scan JSON is unchanged. Its `last-commit` and
|
|
`last-updated` fields contain the database revision and timestamp above. Metadata
|
|
records the audit time, tool version, report SHA-256, and the audited `Cargo.lock`
|
|
SHA-256: `341839930e9b231b548dbd1dbbc8e497531ff9c4903b3cf07722f3d9f024e2d8`.
|
|
|
|
To repeat the audit:
|
|
|
|
```sh
|
|
cargo audit --file Cargo.lock --json
|
|
```
|
|
|
|
No `--ignore` exceptions were used. The scan did not modify the manifest or lockfile.
|
|
|
|
| Dependency | Release version | Reason |
|
|
| --- | --- | --- |
|
|
| `zip` | 9.1.2 | Replaced 2.6.1, affected by RUSTSEC-2026-0367, -0368, and -0369. The application creates archives rather than invoking the affected extraction functions, but the release still uses the corrected library. |
|
|
| `jsonwebtoken` | 11.1.0 with `aws_lc_rs` | Replaced 9.3.1, affected by CVE-2026-25537. Corrected validation rejects invalid date types; additional application tests cover `exp`, `nbf`, algorithm, signature, and compatibility with Python HS256 tokens. |
|
|
| `tokio` | 1.54.1 | Includes fixes for RUSTSEC-2026-0384 and RUSTSEC-2026-0386. |
|
|
| `rustls-webpki` | 0.103.16 | Uses the corrected version assessed by the recorded RustSec database. |
|
|
| `ssh2` / `libssh2-sys` | 0.9.6 / locally patched 0.3.3 | Adds missing fixes to the bundled C code, described below. |
|
|
|
|
Sources: [RustSec 0367](https://rustsec.org/advisories/RUSTSEC-2026-0367.html),
|
|
[0368](https://rustsec.org/advisories/RUSTSEC-2026-0368.html),
|
|
[0369](https://rustsec.org/advisories/RUSTSEC-2026-0369.html),
|
|
[jsonwebtoken maintainer advisory](https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc),
|
|
[RustSec 0384](https://rustsec.org/advisories/RUSTSEC-2026-0384.html), and
|
|
[0386](https://rustsec.org/advisories/RUSTSEC-2026-0386.html).
|
|
|
|
## Local API documentation assets — revision 3
|
|
|
|
Swagger UI comes from the pinned official `swagger-ui-dist 5.34.0` package. The
|
|
archive's integrity was checked against its published npm SHA-512 value. The retained
|
|
files' SHA-256 values and source are recorded in `vendor/swagger-ui/PROVENANCE.json`.
|
|
The license, NOTICE, and embedded-library license information are retained. Neither
|
|
the application nor the browser fetches these assets from a CDN.
|
|
|
|
The documentation loads only its local specification. The online validator,
|
|
query-string configuration, and persistent authorization are disabled. A same-origin
|
|
request interceptor and CSP restrict requests. The RustSec audit above covers Rust
|
|
dependencies; it is not a JavaScript security scan of this package. See
|
|
[API documentation integration](api-documentation.md) for provenance and behavior.
|
|
Revision 4 changes how these checked-in files are embedded, without replacing the
|
|
vendored Swagger UI files.
|
|
|
|
## Bundled libssh2 fixes
|
|
|
|
A current crate version alone was insufficient. Published `libssh2-sys 0.3.3`
|
|
contained a libssh2 1.11.1 base with four earlier backports, but omitted later fixes.
|
|
Specific functions were compared against upstream libssh2 patches. This confirmed
|
|
missing AES-GCM bounds checks, short ETM packet checks, and the other corrections
|
|
listed below. The application uses the affected encryption negotiation and SFTP
|
|
code, so the release includes code fixes rather than only documenting the findings.
|
|
|
|
`vendor/libssh2-sys` contains the original sources needed for compilation, original
|
|
licenses, preserved upstream patches, their SHA-256 values, and a patch reproducing
|
|
the changes. Cargo uses this local dependency. Compilation always uses the patched
|
|
code; it does not silently substitute a system libssh2.
|
|
|
|
| Advisory | Fix scope | Upstream source |
|
|
| --- | --- | --- |
|
|
| CVE-2026-7598 | Username and authentication data lengths | [256d04b60d80](https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1) |
|
|
| CVE-2026-66032 | Double-free of an SFTP file-open response | [5e4776146552](https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0) |
|
|
| CVE-2026-66033 | AES-GCM buffer bounds and release-build length calculation | [a2ed82d40964](https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6) |
|
|
| CVE-2026-66034 | Comment length in a publickey subsystem response | [a13bb6c773f0](https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9) |
|
|
| CVE-2026-66035 | Minimum ETM packet length before decryption | [42e33d81577e](https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4) |
|
|
| CVE-2026-58050 | Publickey attribute limit before allocation | [34497525929b](https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12) |
|
|
| CVE-2026-58051 | Publickey list entry initialization before cleanup | [a9758da45a52](https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a) |
|
|
|
|
Two upstream follow-up fixes for freeing partially created attributes and initializing
|
|
the list tail are also included. Full commit IDs, private-function name adaptations,
|
|
and reproduction instructions are in
|
|
[`PROVENANCE.md`](../vendor/libssh2-sys/PROVENANCE.md). Distribution notices
|
|
[USN-8722-1](https://ubuntu.com/security/notices/USN-8722-1) and
|
|
[USN-8799-1](https://ubuntu.com/security/notices/USN-8799-1) independently describe
|
|
these advisory families.
|
|
|
|
## Verification and limits
|
|
|
|
The patch was reproduced on a fresh copy of the published crate; all seven modified
|
|
files matched the bundled code byte for byte. `vendor/libssh2-sys/SHA256SUMS` supports
|
|
integrity checks of the included files.
|
|
|
|
A separate C regression program in the source tree invokes the same static library
|
|
with invalid AES-GCM lengths and overflowing username lengths. Its execution
|
|
instructions are in `PROVENANCE.md`. Actual build, Rust-test, C-test, and SSH-session
|
|
results are recorded by revision in [the validation report](validation.md).
|
|
|
|
RustSec checks Rust dependency identities and versions. It does not replace C code
|
|
review, container image scanning, or updates to system OpenSSL and zlib libraries.
|
|
Local SSH-server tests exercise the real protocol, but do not reproduce every attack
|
|
family or establish compatibility with every physical MikroTik model. Dependency
|
|
updates require a new scan, relevant tests, and comparison of these backports with
|
|
the newer upstream release.
|