Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_vex",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Seven RUSTSEC advisories surfaced by `cargo audit` and `cargo deny check` against the v0.1.37 workspace are reported as transitive findings via the `rprobe = 0.9` `[dev-dependencies]` of `vl-web`. All seven are `not_affected` for shipped nvulnlookup binaries because rprobe is a test-only dependency and never linked into the production artefacts. This advisory documents the disposition + reachability analysis for each finding so downstream auditors can verify the call graph independently.",
"title": "Summary"
},
{
"category": "description",
"text": "rprobe 0.9 is the latest version published to crates.io and pulls a frozen `sled 0.34` / `parking_lot 0.11` / `rustls 0.21` stack whose deeper dependencies have outstanding RUSTSEC entries. rprobe is consumed in EXACTLY ONE place in our tree: `crates/vl-web/tests/test_rprobe_smoke.rs`, an `#[ignore]`-marked integration test that calls `rprobe::tls_analyzer::TlsAnalyzer::analyze(...)` against a live `vl-web` instance to confirm TLS 1.3 negotiation. The dependency is declared in `[dev-dependencies]` (see `crates/vl-web/Cargo.toml:88`), so cargo never links it into the release binary. Operationally the TLS 1.3 mandate (CLAUDE.md §Encryption Data-in-Transit) is enforced by gate 9b (`test/testssl/run.sh`), which runs against the live binary with the standalone `testssl.sh` toolchain — that is the path a real auditor walks, not the rprobe smoke test.\n\nFindings covered by this VEX bundle (all sharing the `rprobe 0.9 → ...` dep-tree root):\n\n - RUSTSEC-2024-0384 `instant` unmaintained\n via parking_lot_core 0.8.6 → parking_lot 0.11.2 → sled 0.34.7 → rprobe 0.9.0\n - RUSTSEC-2025-0057 `fxhash` unmaintained\n via rprobe 0.9.0 transitive\n - RUSTSEC-2025-0119 `number_prefix` unmaintained\n via indicatif 0.17.11 → rprobe 0.9.0\n - RUSTSEC-2025-0141 `bincode` 1.x unmaintained\n via rprobe 0.9.0 transitive\n - RUSTSEC-2026-0098 `rustls-webpki` 0.101 — name constraints for URI names incorrectly accepted\n via rustls 0.21.12 → rprobe 0.9.0\n - RUSTSEC-2026-0099 `rustls-webpki` 0.101 — wildcard name-constraint bypass (alias GHSA-xgp8-3hg3-c2mh)\n via rustls 0.21.12 → rprobe 0.9.0\n - RUSTSEC-2026-0104 `rustls-webpki` 0.101 — reachable panic in CRL parsing\n via rustls 0.21.12 → rprobe 0.9.0",
"title": "Description"
},
{
"category": "details",
"text": "Reachability analysis (per finding):\n\n - All `unmaintained` advisories (instant / fxhash / number_prefix / bincode) are *informational* RUSTSEC entries; they describe stagnant upstream maintenance, not exploitable bugs. The crates ship in our test build only and are not invoked outside an `#[ignore]`d test.\n\n - The two name-constraint bypasses (RUSTSEC-2026-0098 / -0099) require a misissued certificate that asserts a wildcard or URI name explicitly forbidden by a permitted-subtree constraint. Our smoke test only ever calls `TlsAnalyzer::analyze` against a known-good local nvulnlookup instance with a freshly-generated rcgen self-signed cert — there is no path to a misissued cert in the test fixture.\n\n - The CRL parse panic (RUSTSEC-2026-0104) is reachable only when an application calls `BorrowedCertRevocationList::from_der` or `OwnedCertRevocationList::from_der`. rprobe's TLS analyser does not parse CRLs, and our test uses a freshly minted ephemeral cert with no CRL distribution point.\n\nProduction-binary impact:\n\n - rprobe is `[dev-dependencies]`-only. `cargo build --release -p vl-web` does NOT link rprobe, sled, or rustls 0.21. The release artefact's `cargo-auditable` `.dep-v0` SBOM (verified per release with `rust-audit-info`) confirms zero rprobe / sled / rustls 0.21 entries.\n\n - The `cargo-auditable` SBOM is also the target of the binary-scan gate (`8b. trivy + syft + osv-scanner`); those scanners do NOT report any of the seven findings against the release binary because the offending crates are absent from the linked dep tree.\n\nDisposition: NOT AFFECTED for every shipped nvulnlookup version. The seven RUSTSEC IDs are listed in `vulnerability-lookup-rs/audit.toml` and `vulnerability-lookup-rs/deny.toml` `ignore = [...]` arrays with the same justification as this VEX advisory; the canonical source of truth is this document.",
"title": "Reachability + Disposition"
},
{
"category": "general",
"text": "Recommended action for downstream consumers:\n\n 1. Run `cargo build --release` (NOT `cargo build --tests`) for production deployments. The release binary has zero exposure to the seven findings.\n\n 2. If you re-run `cargo test` in your environment, the `test_rprobe_smoke` test is `#[ignore]`d by default. It only runs under `cargo test -- --ignored`. Treat opt-in execution as a development-time choice, not a deployment posture.\n\n 3. When rprobe upstream cuts a release on rustls 0.23+ (and dependency-pinned bincode 2.x / lru 0.13+ / etc.), drop the seven RUSTSEC entries from `audit.toml` / `deny.toml` and supersede this advisory with a final-status revision.\n\n 4. The TLS 1.3 mandate continues to be enforced by `testssl.sh` (gate 9b) and the per-listener TLS conformance test under `test/testssl/run.sh`. Operators do NOT need rprobe to verify TLS posture.\n\nNo workaround is required for already-deployed binaries. No CVE has been assigned to any of the seven findings against nvulnlookup because none is reachable from the shipped product.",
"title": "Recommended action"
},
{
"category": "other",
"text": "Disposition: VEX `not_affected` for every nvulnlookup version 0.1.30 and later. The seven findings sit on a frozen test-only branch of the dep tree. This advisory will be revised to status `final` once rprobe upstream publishes a release on the modern rustls / bincode / lru stack.",
"title": "Disposition"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/033/ndaal-sa-2026-033.json"
},
{
"category": "external",
"summary": "RUSTSEC-2024-0384 — instant unmaintained",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0384"
},
{
"category": "external",
"summary": "RUSTSEC-2025-0057 — fxhash unmaintained",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0057"
},
{
"category": "external",
"summary": "RUSTSEC-2025-0119 — number_prefix unmaintained",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0119"
},
{
"category": "external",
"summary": "RUSTSEC-2025-0141 — bincode unmaintained",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0141"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0098 — rustls-webpki URI name-constraint bypass",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0098"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0099 — rustls-webpki wildcard name-constraint bypass",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0099"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0104 — rustls-webpki CRL panic",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0104"
},
{
"category": "external",
"summary": "rprobe on crates.io",
"url": "https://crates.io/crates/rprobe"
}
],
"title": "ndaal VEX Advisory: 7 rprobe-transitive RUSTSEC findings — not_affected (test-only dev-dependency)",
"tracking": {
"current_release_date": "2026-04-25T21:03:36.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-033",
"initial_release_date": "2026-04-25T21:03:36.000Z",
"revision_history": [
{
"date": "2026-04-25T21:03:36.000Z",
"number": "1.0.0",
"summary": "Initial VEX advisory bundling the seven rprobe-transitive RUSTSEC findings (RUSTSEC-2024-0384, -2025-0057, -2025-0119, -2025-0141, -2026-0098, -2026-0099, -2026-0104) and recording disposition `not_affected` for every shipped nvulnlookup version. Mirrored in `vulnerability-lookup-rs/audit.toml` and `deny.toml` `ignore = [...]` arrays with the same per-entry justification. Status: interim until rprobe upstream cuts a release on rustls 0.23+."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "nvulnlookup",
"branches": [
{
"category": "product_version_range",
"name": ">=0.1.30,<=0.1.37",
"product": {
"name": "nvulnlookup 0.1.30 .. 0.1.37 — test-only rprobe dev-dep, no release-binary linkage to affected crates",
"product_id": "CSAFPID-0001"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2024-0384"
}
],
"notes": [
{
"category": "description",
"text": "instant — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2024-0384",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `parking_lot_core 0.8.6 → parking_lot 0.11.2 → sled 0.34.7 → rprobe 0.9.0 → (dev) vl-web`. Test-only dependency; not present in the release binary."
}
],
"title": "instant — crate unmaintained",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2025-0057"
}
],
"notes": [
{
"category": "description",
"text": "fxhash — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2025-0057",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `rprobe 0.9.0 → (dev) vl-web`. Test-only dependency."
}
],
"title": "fxhash — crate unmaintained",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2025-0119"
}
],
"notes": [
{
"category": "description",
"text": "number_prefix — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2025-0119",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `indicatif 0.17.11 → rprobe 0.9.0 → (dev) vl-web`. Test-only dependency."
}
],
"title": "number_prefix — crate unmaintained",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2025-0141"
}
],
"notes": [
{
"category": "description",
"text": "bincode 1.x — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2025-0141",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `rprobe 0.9.0 → (dev) vl-web`. Test-only dependency."
}
],
"title": "bincode 1.x — crate unmaintained",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2026-0098"
}
],
"notes": [
{
"category": "description",
"text": "rustls-webpki — name constraints for URI names were incorrectly accepted. Identifiers: RustSec Advisory Database:RUSTSEC-2026-0098",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `rustls 0.21.12 → rprobe 0.9.0 → (dev) vl-web`. Reachability requires a misissued cert with a URI-name component the smoke test never sees; the local nvulnlookup target uses a freshly generated rcgen self-signed cert."
}
],
"title": "rustls-webpki — name constraints for URI names were incorrectly accepted",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2026-0099"
}
],
"notes": [
{
"category": "description",
"text": "rustls-webpki — wildcard-name-constraint bypass (alias GHSA-xgp8-3hg3-c2mh). Identifiers: RustSec Advisory Database:RUSTSEC-2026-0099",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `rustls 0.21.12 → rprobe 0.9.0 → (dev) vl-web`. Reachability requires a misissued cert; not encountered in the smoke-test fixture."
}
],
"title": "rustls-webpki — wildcard-name-constraint bypass (alias GHSA-xgp8-3hg3-c2mh)",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2026-0104"
}
],
"notes": [
{
"category": "description",
"text": "rustls-webpki — reachable panic in CRL parsing. Identifiers: RustSec Advisory Database:RUSTSEC-2026-0104",
"title": "Description"
}
],
"product_status": {
"known_not_affected": [
"CSAFPID-0001"
]
},
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Reached only through `rustls 0.21.12 → rprobe 0.9.0 → (dev) vl-web`. Reachability requires the application to parse a CRL; the smoke test does not parse CRLs (no CRL distribution point on the ephemeral self-signed cert)."
}
],
"title": "rustls-webpki — reachable panic in CRL parsing",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"CSAFPID-0001"
]
}
]
}
]
}