Repository navigation
Conversation
…i (LOG-10499) Backport the upstream rustls-webpki 0.103.16 distrusted-SPKI rejection (bz#2561996) into a forked 0.102.8 crate under patch/, and bump the 0.103-line copy to the fixed 0.103.16 release. rustls-webpki versions below 0.103.16 accept certificate paths containing the distrusted emSign intermediate public keys (their private keys are publicly known) whenever the configured trust anchors allow such paths. In the ocp-logging build the crate is reachable through: - google-cloud-auth / reqwest 0.12 (GCP sink OAuth token fetch, rustls 0.23 -> rustls-webpki 0.103.x, fixed by the lockfile bump to 0.103.16) - tonic 0.11 (OTLP gRPC TLS, rustls 0.22 -> rustls-webpki 0.102.8, fixed by the forked crate; the 0.101/0.102 lines have no upstream fixed release) The residual 0.101.7 copy (vector-api-client websockets for vector top/tap, rustls 0.21) remains on an unfixed line; it is admin tooling that connects to the local API and is not part of the collector data path. Full remediation of that copy requires consolidating on rustls 0.23. Fixes: LOG-10499, LOG-10500, LOG-10506 (and LOG-10502 via v0.47.0-rh) Co-Authored-By: Claude Code <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jcantrill The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold |
Summary
Fixes bz#2561996 / LOG-10499, LOG-10500, LOG-10506 (openshift-logging-6.6): rustls-webpki below 0.103.16 accepts certificate paths containing the distrusted emSign intermediate public keys (their private keys are publicly known) whenever the configured trust anchors allow such paths.
Two changes:
rustls-webpki0.103.10 → 0.103.16 (the upstream fixed release; forces aws-lc-rs 1.19.0 / aws-lc-sys 0.47.0, which 0.103.16 requires). This covers the GCP sink OAuth token fetch path (google-cloud-auth → reqwest 0.12 rustls-only → rustls 0.23).build_chain_inner+Error::CertDistrusted), following the existing patch/openssl and patch/hyper convention. This covers the tonic 0.11 OTLP gRPC TLS path (rustls 0.22 → rustls-webpki 0.102.8). The 0.101/0.102 lines have no upstream fixed release.Residual risk (documented, accepted)
The 0.101.7 copy (vector-api-client websockets for
vector top/tap, rustls 0.21) remains on an unfixed line. It is admin tooling connecting to the local API, not part of the collector data path. Full remediation requires consolidating on rustls 0.23. The pending ca-certificates errata for CVE-2026-114406 (removes the emSign root from the system trust store) also removes the trust anchor this flaw needs.Verification
cargo test --features "alloc std ring" --lib— 64/64 pass, including the backporteddistrusted_spkiregression test; also compiles with theaws_lc_rsfeaturecargo check --no-default-features --features ocp-loggingpasses in the builder container environment (host lacks openssl-devel)cargo tree -i rustls-webpkiconfirms 0.102.8 resolves to the patched path crate; 0.103.16 from the registryCompanion PR to the v0.47.0-rh backport of the same fix.
🤖 Generated with Claude Code