Closed renovate-bot closed 4 months ago
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
â™» Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path distributor/Cargo.toml --workspace
warning: profiles for the non root package will be ignored, specify profiles at the workspace root:
package: /tmp/renovate/repos/github/google/sxg-rs/cloudflare_worker/Cargo.toml
workspace: /tmp/renovate/repos/github/google/sxg-rs/Cargo.toml
warning: profiles for the non root package will be ignored, specify profiles at the workspace root:
package: /tmp/renovate/repos/github/google/sxg-rs/fastly_compute/Cargo.toml
workspace: /tmp/renovate/repos/github/google/sxg-rs/Cargo.toml
Updating crates.io index
Updating git repository `https://github.com/felipenoris/hyper-reverse-proxy`
From https://github.com/felipenoris/hyper-reverse-proxy
* [new ref] 96a398de8522fac07a5e15bd0699f6cd7fa84bce -> refs/commit/96a398de8522fac07a5e15bd0699f6cd7fa84bce
* [new tag] v0.3.0 -> v0.3.0
* [new tag] v0.4.0 -> v0.4.0
* [new tag] v0.5.0 -> v0.5.0
* [new tag] v0.5.1 -> v0.5.1
error: failed to select a version for `tls-listener`.
... required by package `distributor v0.1.0 (/tmp/renovate/repos/github/google/sxg-rs/distributor)`
versions that meet the requirements `^0.10.0` are: 0.10.0
the package `distributor` depends on `tls-listener`, with features: `hyper-h1` but `tls-listener` does not have these features.
failed to select a version for `tls-listener` which could resolve this conflict
This PR contains the following updates:
0.5.1
->0.10.0
GitHub Vulnerability Alerts
CVE-2024-28854
Summary
With the default configuration of tls-listener, a malicious user can open 6.4
TcpStream
s a second, sending 0 bytes, and can trigger a DoS.Details
The default configuration options make any public service using
TlsListener::new()
vulnerable to a slow-loris DoS attack.PoC
Running the HTTP TLS server example: https://github.com/tmccombs/tls-listener/blob/6c57dea2d9beb1577ae4d80f6eaf03aad4ef3857/examples/http.rs, then running the following script will prevent new connections to the server.
Impact
This is an instance of a slow-loris attack. This impacts any publically accessible service using the default configuration of
tls-listener
Mitigation
Previous versions can mitigate this by passing a large value, such as
usize::MAX
as the parameter toBuilder::max_handshakes
.Release Notes
tmccombs/tls-listener (tls-listener)
### [`v0.10.0`](https://togithub.com/tmccombs/tls-listener/blob/HEAD/CHANGELOG.md#0100---2024-03-15) [Compare Source](https://togithub.com/tmccombs/tls-listener/compare/v0.9.1...v0.10.0) ##### Security Advisory Versions prior to this using the default configuration are vulnerable to a Slowloris attack. This version mitigates the vulnerability. Previous versions can mitigate the vulnerability by increasing the value passed to `Builder::max_handshakes` to a large number (such as `usize::MAX`). Decreasing the `handshake_timeout` can also help, although it is still strongly recommended to increase the `max_handshakes` more than the current default. ##### Changes - \[**breaking**] Change `poll_accept` not to have a limit on the number of pending handshakes in the queue, so that connections that are not making progress towards completing the handshake will not block other connections from being accepted. This replaces `Builder::max_handshakes` with `Builder::accept_batch_size`. ### [`v0.9.1`](https://togithub.com/tmccombs/tls-listener/blob/HEAD/CHANGELOG.md#091---2023-12-23) [Compare Source](https://togithub.com/tmccombs/tls-listener/compare/v0.9.0...v0.9.1) ##### Miscellaneous Tasks - Update tokio-rustls ### [`v0.9.0`](https://togithub.com/tmccombs/tls-listener/blob/HEAD/CHANGELOG.md#090---2023-12-05) [Compare Source](https://togithub.com/tmccombs/tls-listener/compare/v0.8.0...v0.9.0) ##### Features - \[**breaking**] Remove until & remove option from accept - BREAKING CHANGE: remove `until` from AsyncAccept trait. Use `StreamExt.take_until` on the TlsListener instead. - BREAKING CHANGE: `accept` fn on AsyncAccept trait no longer returns an Option - BREAKING CHANGE: `accept` fn on TlsListener no longer returns an Option ##### Upgrade - \[**breaking**] Update to hyper 1.0 - BREAKING CHANGE: Removed hyper-h1 and hyper-h2 features ### [`v0.8.0`](https://togithub.com/tmccombs/tls-listener/blob/HEAD/CHANGELOG.md#080---2023-10-19) [Compare Source](https://togithub.com/tmccombs/tls-listener/compare/v0.7.0...v0.8.0) This is a backwards incompatible release. The main change is that accepting a new connection now returns a tuple of the new connection, and the peer address. The `AsyncAccept` trait was also changed similarly. The `Error` enum was also changed to provide more details about the error. And if the handshake times out, it now returns an error instead of silently waiting for the next connection. ##### Features - \[**breaking**] Add a new error type for handshake timeouts - BREAKING CHANGE: Adds a new variant to the Error Enum - BREAKING CHANGE: The Error enum is now non_exhaustive - BREAKING CHANGE: Now returns an error if a handshake times out - \[**breaking**] Yield remote address upon accepting a connection, and include it in errors. - BREAKING CHANGE: The enum variant `Error::ListenerError` is now struct-like instead of tuple-like, and is `non_exhaustive` like the enum itself. - BREAKING CHANGE: `Error` now has three type parameters, not two. - BREAKING CHANGE: `TlsListener::accept` and `Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.