[
https://issues.apache.org/jira/browse/SPARK-60371?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
L. C. Hsieh resolved SPARK-60371.
---------------------------------
Fix Version/s: connect-gateway-0.1.0
Resolution: Fixed
Issue resolved by pull request 51
[https://github.com/apache/spark-connect-gateway/pull/51]
> Update quinn-proto and rustls in Cargo.lock to pick up recent RustSec
> advisories
> --------------------------------------------------------------------------------
>
> Key: SPARK-60371
> URL: https://issues.apache.org/jira/browse/SPARK-60371
> Project: Spark
> Issue Type: Sub-task
> Components: Connect
> Affects Versions: connect-gateway-0.1.0
> Reporter: L. C. Hsieh
> Assignee: L. C. Hsieh
> Priority: Major
> Labels: pull-request-available
> Fix For: connect-gateway-0.1.0
>
>
> `cargo audit` against main (af4f080) reports nine advisories published in the
> last week, all with fixed releases. This updates the two affected crates in
> Cargo.lock only; no Cargo.toml change is needed.
> quinn-proto 0.11.16 -> 0.11.19 (fixed in >= 0.11.18)
> RUSTSEC-2026-0338 zero-length STREAM frames can panic during unordered
> reads
> RUSTSEC-2026-0339 unbounded growth of pending connection ID retirements
> RUSTSEC-2026-0340 peer minimum ACK delay can panic with ACK_FREQUENCY
> RUSTSEC-2026-0341 stream reassembly memory-exhaustion guard can be bypassed
> RUSTSEC-2026-0342 zero-length DATAGRAM frames bypass the receive buffer
> limit
> The gateway is not exposed: quinn is enabled only by reqwest's `http3`
> feature, which the workspace does not turn on (reqwest is built with
> `rustls-tls` and `json`). quinn-proto appears in Cargo.lock but is never
> compiled. `cargo audit` reads the lockfile rather than the build graph, so
> it still reports these, and updating is preferable to ignoring advisories
> that have a fix.
> rustls 0.23.45 -> 0.23.46
> RUSTSEC-2026-0346 Debug impls for client session values expose TLS secrets
> RUSTSEC-2026-0347 buffered application data sent to outer server after ECH
> rejection
> RUSTSEC-2026-0348 brotli certificate decompression can allocate up to 1 GiB
> before authentication
> RUSTSEC-2026-0349 unauthenticated ServerHello can downgrade later
> connections to classical key exchange
> The gateway uses rustls only as a TLS client (kube-client for the K8s API,
> reqwest for OIDC JWKS, opentelemetry-otlp), so these do apply. They are
> fixed
> in a patch release.
> This is a prerequisite for SPARK-60370: the audit workflow fails while any of
> these advisories is present.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
