7.2 KiB
Dependency review — release 0.0.1
The audit documented here was performed on 27 October 2026 for source revision 2
of release 0.0.1. Its scope was Cargo.lock, known public advisories, and the C SSH
library bundled through libssh2-sys. Revision 3 additionally verified the provenance
of local Swagger UI assets. These historical checks are not a claim that a new
advisory scan has been run for revision 4; see the validation report.
A scanner result is limited to its advisory database and examined versions and does
not establish the absence of every vulnerability.
RustSec and dependency changes
The recorded run used cargo-audit 0.22.2 and a RustSec database containing
1,380 advisories, at commit 99670cfc0bc574433034b75876a4b791ccaa2efb, last updated
2026-10-27T11:02:42+01:00. The audited dependency set produced 0 reported
vulnerabilities and 0 warnings. The complete JSON result is preserved in
dependency-audit.json; the lockfile identity is recorded in
dependency-audit-metadata.json.
The original final revision 2 scan JSON is unchanged. Its last-commit and
last-updated fields contain the database revision and timestamp above. Metadata
records the audit time, tool version, report SHA-256, and the audited Cargo.lock
SHA-256: 341839930e9b231b548dbd1dbbc8e497531ff9c4903b3cf07722f3d9f024e2d8.
To repeat the audit:
cargo audit --file Cargo.lock --json
No --ignore exceptions were used. The scan did not modify the manifest or lockfile.
| Dependency | Release version | Reason |
|---|---|---|
zip |
9.1.2 | Replaced 2.6.1, affected by RUSTSEC-2026-0367, -0368, and -0369. The application creates archives rather than invoking the affected extraction functions, but the release still uses the corrected library. |
jsonwebtoken |
11.1.0 with aws_lc_rs |
Replaced 9.3.1, affected by CVE-2026-25537. Corrected validation rejects invalid date types; additional application tests cover exp, nbf, algorithm, signature, and compatibility with Python HS256 tokens. |
tokio |
1.54.1 | Includes fixes for RUSTSEC-2026-0384 and RUSTSEC-2026-0386. |
rustls-webpki |
0.103.16 | Uses the corrected version assessed by the recorded RustSec database. |
ssh2 / libssh2-sys |
0.9.6 / locally patched 0.3.3 | Adds missing fixes to the bundled C code, described below. |
Sources: RustSec 0367, 0368, 0369, jsonwebtoken maintainer advisory, RustSec 0384, and 0386.
Local API documentation assets — revision 3
Swagger UI comes from the pinned official swagger-ui-dist 5.34.0 package. The
archive's integrity was checked against its published npm SHA-512 value. The retained
files' SHA-256 values and source are recorded in vendor/swagger-ui/PROVENANCE.json.
The license, NOTICE, and embedded-library license information are retained. Neither
the application nor the browser fetches these assets from a CDN.
The documentation loads only its local specification. The online validator, query-string configuration, and persistent authorization are disabled. A same-origin request interceptor and CSP restrict requests. The RustSec audit above covers Rust dependencies; it is not a JavaScript security scan of this package. See API documentation integration for provenance and behavior. Revision 4 changes how these checked-in files are embedded, without replacing the vendored Swagger UI files.
Bundled libssh2 fixes
A current crate version alone was insufficient. Published libssh2-sys 0.3.3
contained a libssh2 1.11.1 base with four earlier backports, but omitted later fixes.
Specific functions were compared against upstream libssh2 patches. This confirmed
missing AES-GCM bounds checks, short ETM packet checks, and the other corrections
listed below. The application uses the affected encryption negotiation and SFTP
code, so the release includes code fixes rather than only documenting the findings.
vendor/libssh2-sys contains the original sources needed for compilation, original
licenses, preserved upstream patches, their SHA-256 values, and a patch reproducing
the changes. Cargo uses this local dependency. Compilation always uses the patched
code; it does not silently substitute a system libssh2.
| Advisory | Fix scope | Upstream source |
|---|---|---|
| CVE-2026-7598 | Username and authentication data lengths | 256d04b60d80 |
| CVE-2026-66032 | Double-free of an SFTP file-open response | 5e4776146552 |
| CVE-2026-66033 | AES-GCM buffer bounds and release-build length calculation | a2ed82d40964 |
| CVE-2026-66034 | Comment length in a publickey subsystem response | a13bb6c773f0 |
| CVE-2026-66035 | Minimum ETM packet length before decryption | 42e33d81577e |
| CVE-2026-58050 | Publickey attribute limit before allocation | 34497525929b |
| CVE-2026-58051 | Publickey list entry initialization before cleanup | a9758da45a52 |
Two upstream follow-up fixes for freeing partially created attributes and initializing
the list tail are also included. Full commit IDs, private-function name adaptations,
and reproduction instructions are in
PROVENANCE.md. Distribution notices
USN-8722-1 and
USN-8799-1 independently describe
these advisory families.
Verification and limits
The patch was reproduced on a fresh copy of the published crate; all seven modified
files matched the bundled code byte for byte. vendor/libssh2-sys/SHA256SUMS supports
integrity checks of the included files.
A separate C regression program in the source tree invokes the same static library
with invalid AES-GCM lengths and overflowing username lengths. Its execution
instructions are in PROVENANCE.md. Actual build, Rust-test, C-test, and SSH-session
results are recorded by revision in the validation report.
RustSec checks Rust dependency identities and versions. It does not replace C code review, container image scanning, or updates to system OpenSSL and zlib libraries. Local SSH-server tests exercise the real protocol, but do not reproduce every attack family or establish compatibility with every physical MikroTik model. Dependency updates require a new scan, relevant tests, and comparison of these backports with the newer upstream release.