Threats tagged 'ghsa-67mj-442h-2gp6'

Rustls versions before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 have an information disclosure vulnerability. The issue arises from the Debug formatting of client session values, which can expose secret key material. Specifically, custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue may leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to anyone with access to the logs.