L. C. Hsieh created SPARK-60369:
-----------------------------------
Summary: Track RUSTSEC-2023-0071 (Marvin Attack in rsa) until a
fixed release exists
Key: SPARK-60369
URL: https://issues.apache.org/jira/browse/SPARK-60369
Project: Spark
Issue Type: Sub-task
Components: Connect
Affects Versions: connect-gateway-0.1.0
Reporter: L. C. Hsieh
Assignee: L. C. Hsieh
`cargo audit` reports RUSTSEC-2023-0071 against rsa 0.9.10: a timing
sidechannel in RSA private-key operations that can allow key recovery
(CVSS 5.9). No fixed version exists: 0.9.10 is the latest stable release,
0.10 is only available as a pre-release (0.10.0-rc.19), and the advisory
lists no patched version.
The gateway's exposure is low. rsa reaches production code only through
jsonwebtoken (rust_crypto provider, selected in SPARK-59552), where it
verifies RS256 signatures with a public key. Verification involves no
secret, so there is nothing for the attack to recover. Every private-key
use in the workspace (EncodingKey, RsaPrivateKey) is inside #[cfg(test)],
and the direct rsa dependency in crates/auth is a dev-dependency.
The advisory is therefore ignored in .cargo/audit.toml so that `cargo
audit` in CI can gate on everything else. This issue exists so the ignore
has an owner and an exit condition.
Close this when either:
- rsa ships a stable release containing the fix, and jsonwebtoken (or our
own dependency) moves onto it; then remove the ignore, or
- the gateway starts performing RSA private-key operations in production
code (for example signing tokens), in which case the exposure analysis
above no longer holds and this needs revisiting immediately.
Related: jsonwebtoken 10 -> 11 (dependabot PR #39) does not change this,
since 11 still uses rsa 0.9.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
