fix: drop the legacy TLS stack pulling a vulnerable rustls-webpki - #7
Merged
Conversation
Dependabot's security update for rustls-webpki has been failing with
`security_update_not_possible`: the advisory is fixed in 0.103.13, but
the tree could only resolve 0.101.7, and Dependabot reported no
conflicting dependency it could act on.
The vulnerable copy came in through aws-sdk-bedrockruntime's default
features, which include `rustls`. That maps to
aws-smithy-runtime/tls-rustls, which maps to
aws-smithy-http-client/legacy-rustls-ring, which pins rustls 0.21 and
hyper-rustls 0.24 -- and rustls 0.21 cannot take a webpki new enough to
carry the fix. So both stacks were being compiled in: the legacy one on
0.101.7 and the modern one on 0.103.13.
That feature is redundant. `default-https-client`, also on by default,
already supplies TLS through rustls-aws-lc on rustls 0.23. Turning off
default features and asking for only what is used leaves one TLS stack.
rustls-webpki 0.101.7 + 0.103.13 -> 0.103.13
rustls 0.21.12 + 0.23.41 -> 0.23.41
aws-lc-rs was already being built, since `default-https-client` was
already enabled, so this adds no new build-time requirement.
487 tests pass unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JNhUehmChiQKJUjv3QPnkH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot's security update for
rustls-webpkihas been failing on every run withsecurity_update_not_possible— the advisory is fixed in 0.103.13, the tree could only resolve 0.101.7, and it reported no conflicting dependency it could act on.Where it came from
aws-sdk-bedrockruntime's default features includerustls:So both TLS stacks were being compiled in — the legacy one on the vulnerable webpki, and the modern one alongside it. That's also why Dependabot couldn't see a conflict to report: nothing was blocking the upgrade, a second obsolete path was simply being pulled in beside it.
The fix
That feature is redundant.
default-https-client, also on by default, already supplies TLS viarustls-aws-lcon rustls 0.23. Turning off default features and requesting only what is used collapses it to one stack:rustls-webpkirustlsaws-lc-rswas already in the lockfile becausedefault-https-clientwas already enabled, so this adds no new build-time requirement (no new cmake/nasm dependency).487 tests pass unchanged.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JNhUehmChiQKJUjv3QPnkH