[dependabot]

Bumps the cargo-security-updates group with 4 updates in the / directory: tokio, tracing-subscriber, ring and rustls.

Updates tokio from 1.41.0 to 1.43.1

Release notes

Sourced from tokio's releases.

Tokio v1.43.0

1.43.0 (Jan 8th, 2025)

Added

• net: add UdpSocket::peek methods (#7068)
• net: add support for Haiku OS (#7042)
• process: add Command::into_std() (#7014)
• signal: add SignalKind::info on illumos (#6995)
• signal: add support for realtime signals on illumos (#7029)

Fixed

• io: don't call set_len before initializing vector in Blocking (#7054)
• macros: suppress clippy::needless_return in #[tokio::main] (#6874)
• runtime: fix thread parking on WebAssembly (#7041)

Changes

• chore: use unsync loads for unsync_load (#7073)
• io: use Buf::put_bytes in Repeat read impl (#7055)
• task: drop the join waker of a task eagerly (#6986)

Changes to unstable APIs

• metrics: improve flexibility of H2Histogram Configuration (#6963)
• taskdump: add accessor methods for backtrace (#6975)

Documented

• io: clarify ReadBuf::uninit allows initialized buffers as well (#7053)
• net: fix ambiguity in TcpStream::try_write_vectored docs (#7067)
• runtime: fix LocalRuntime doc links (#7074)
• sync: extend documentation for watch::Receiver::wait_for (#7038)
• sync: fix typos in OnceCell docs (#7047)

#6874: tokio-rs/tokio#6874 #6963: tokio-rs/tokio#6963 #6975: tokio-rs/tokio#6975 #6986: tokio-rs/tokio#6986 #6995: tokio-rs/tokio#6995 #7014: tokio-rs/tokio#7014 #7029: tokio-rs/tokio#7029 #7038: tokio-rs/tokio#7038 #7041: tokio-rs/tokio#7041 #7042: tokio-rs/tokio#7042 #7047: tokio-rs/tokio#7047 #7053: tokio-rs/tokio#7053 #7054: tokio-rs/tokio#7054 #7055: tokio-rs/tokio#7055

... (truncated)

Commits

• a7b658c chore: prepare Tokio v1.43.1 release
• c1c8d10 Merge remote-tracking branch 'origin/tokio-1.38.x' into forward-port-1.38.x
• aa303bc chore: prepare Tokio v1.38.2 release
• 7b6ccb5 chore: backport CI fixes
• 4b174ce sync: fix cloning value when receiving from broadcast channel
• 5f3296d chore: prepare Tokio v1.43.0 (#7079)
• cc974a6 chore: prepare tokio-macros v2.5.0 (#7078)
• 15495fd metrics: improve flexibility of H2Histogram Configuration (#6963)
• ad41834 io: don't call set_len before initializing vector in Blocking (#7054)
• bd3e857 runtime: move is_join_waker_set assertion in unset_waker (#7072)
• Additional commits viewable in compare view

Updates tracing-subscriber from 0.3.18 to 0.3.20

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.20

Security Fix: ANSI Escape Sequence Injection (CVE-TBD)

Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

• Manipulate terminal title bars
• Clear screens or modify terminal display
• Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

Solution

Version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

Affected Versions

All versions of tracing-subscriber prior to 0.3.20 are affected by this vulnerability.

Recommendations

Immediate Action Required: We recommend upgrading to tracing-subscriber 0.3.20 immediately, especially if your application:

• Logs user-provided input (form data, HTTP headers, query parameters, etc.)
• Runs in environments where terminal output is displayed to users

Migration

This is a patch release with no breaking API changes. Simply update your Cargo.toml:

[dependencies]
tracing-subscriber = "0.3.20"

Acknowledgments

We would like to thank zefr0x who responsibly reported the issue at security@tokio.rs.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at security@tokio.rs.

tracing-subscriber 0.3.19

[ [crates.io][crate-0.3.19] ] | [ [docs.rs][docs-0.3.19] ]

This release updates the tracing dependency to [v0.1.41][tracing-0.1.41] and the tracing-serde dependency to [v0.2.0][tracing-serde-0.2.0].

Added

... (truncated)

Commits

• 4c52ca5 fmt: fix ANSI escape sequence injection vulnerability (#3368)
• f71cebe subscriber: impl Clone for EnvFilter (#3360)
• 3a1f571 Fix CI (#3361)
• e63ef57 chore: prepare tracing-attributes 0.1.30 (#3316)
• 6e59a13 attributes: fix tracing::instrument regression around shadowing (#3311)
• e4df761 tracing: update core to 0.1.34 and attributes to 0.1.29 (#3305)
• 643f392 chore: prepare tracing-attributes 0.1.29 (#3304)
• d08e7a6 chore: prepare tracing-core 0.1.34 (#3302)
• 6e70c57 tracing-subscriber: count numbers of enters in Timings (#2944)
• c01d4fd fix docs and enable CI on main branch (#3295)
• Additional commits viewable in compare view

Updates ring from 0.17.8 to 0.17.14

Changelog

Sourced from ring's changelog.

Version 0.17.14 (2025-03-11)

Fixed a performance bug in the AVX2-based AES-GCM implementation added in ring 0.17.13. This will be another notable performance improvement for most newish x86-64 systems. The performance issue impacted not just AES-GCM.

Compatibility with GNU binutils 2.29 (used on Amazon Linux 2), and probably even earlier versions, was restored. It is expected that ring 0.17.14 will build on all the systems that 0.17.12 would build on.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

• Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

• Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

Commits

• See full diff in compare view

Updates rustls from 0.23.16 to 0.23.23

Commits

• 7742147 unbuffered: introduce PeerClosed state
• 7abb149 tests/unbuffered: refactor
• 1963cc7 Bump version to 0.23.23
• ad5a31b tests: reuse SingleCertAndKey
• 591c0c1 crypto: expose SingleCertAndKey
• 82e1688 client: use SingleCertAndKey for with_client_auth_cert()
• b0cc4df crypto: add CertifiedKey::from_der()
• be2865a crypto: simplify SingleCertAndKey construction with OCSP
• 82c3c2d crypto: use From impl to construct SingleCertAndKey
• 27551e1 Move SingleCertAndKey to crypto::signer
• Additional commits viewable in compare view

[mridang]

@dependabot recreate