From 65f398c396a09e2c284b8978966195f68decd303 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 16 Jun 2026 18:12:57 +0100 Subject: [PATCH] feat(rules): detect vulnerable rustls-webpki (<0.103.13) in Cargo.lock Adds a RustSec/GHSA version detector for rustls-webpki to the Cargo.lock rule block (GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, CVSS 7.5 HIGH, fixed 0.103.13). Auto-wired via scan_file; non-auto-fixable (security -> manual review), with a fix suggestion in security_errors.ex. Closes the detection gap for the transitive/lockfile-only class that Dependabot frequently will not auto-PR -- the class that left hyperpolymath/007 alert #4 open. Part of the P0 estate dependency- security control-plane completion. Co-Authored-By: Claude Opus 4.8 (1M context) --- lib/rules/rules.ex | 13 +++++++++++++ lib/rules/security_errors.ex | 1 + 2 files changed, 14 insertions(+) diff --git a/lib/rules/rules.ex b/lib/rules/rules.ex index 096992e1..cd42fcfb 100644 --- a/lib/rules/rules.ex +++ b/lib/rules/rules.ex @@ -246,6 +246,19 @@ defmodule Hypatia.Rules do findings end + # Detect vulnerable rustls-webpki versions (CRL BIT STRING DoS panic) + # GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, CVSS 7.5 HIGH; fixed in 0.103.13. + # Transitive/lockfile-only: Dependabot frequently will NOT auto-PR this -- + # remediation needs a manual `cargo update -p rustls-webpki` (see estate + # baseline dev-notes/2026-06-16-estate-dependency-security-control-plane.md). + findings = + if Regex.match?(~r/name = "rustls-webpki"\s+version = "0\.(101\.\d+|102\.\d+|103\.([0-9]|1[0-2]))"/, content) do + [%{rule: "rustls-webpki-crl-panic-dos", severity: :high, + description: "Vulnerable rustls-webpki version detected in Cargo.lock -- update to >= 0.103.13 (GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, DoS via panic on malformed CRL BIT STRING)"} | findings] + else + findings + end + findings else findings diff --git a/lib/rules/security_errors.ex b/lib/rules/security_errors.ex index 8a044e68..4d87f0a3 100644 --- a/lib/rules/security_errors.ex +++ b/lib/rules/security_errors.ex @@ -190,6 +190,7 @@ defmodule Hypatia.Rules.SecurityErrors do "glib-variantstriter-unsoundness" => "Update glib to v0.22.3, v0.20.7, v0.19.10 or v0.18.6", "protobuf-recursion-crash" => "Update protobuf to >= 3.7.2", "idna-punycode-mishandling" => "Update idna to >= 1.0.0", + "rustls-webpki-crl-panic-dos" => "Update rustls-webpki to >= 0.103.13 (cargo update -p rustls-webpki); transitive dep, Dependabot may not auto-PR", "jsonwebtoken-type-confusion" => "Update jsonwebtoken to >= 10.3.0", "npm-js-yaml-vulnerability" => "Update js-yaml to >= 3.14.2 or 4.1.1", "npm-serialize-javascript-vulnerability" => "Update serialize-javascript to >= 6.0.2 or 7.0.0",