Repository navigation
fix(deps): update ctutils to 0.4.5 for RUSTSEC-2026-0385 - #113
Open
thebrandonlucas wants to merge 1 commit into
Open
thebrandonlucas wants to merge 1 commit into
thebrandonlucas wants to merge 1 commit into
Conversation
ctutils 0.4.2, which the CLI reaches through sha2 and digest, could generate masks and u128 comparisons that branch on secret values. 0.4.4 fixed it; 0.4.5 is the current release. Only the lock file changes.
tee8z
approved these changes
Oct 26, 2026
tee8z
left a comment
tee8z
left a comment
Contributor
There was a problem hiding this comment.
Only ctutils changes in Cargo.lock, and the changelog line matches the earlier RustSec fix. CI is green, including the audit. The branch is 20 commits behind master but merges cleanly. Please merge this before #125: its audit fails only on this advisory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
RUSTSEC-2026-0385, published 2026-10-23, affects
ctutilsbefore 0.4.4. Its constant-time mask generation andu128comparisons can compile to branches, which can leak secret values through timing. The CLI locksctutils 0.4.2, reached throughsha20.11 →digest0.11.3 →ctutils.The RustSec audit now fails on every PR that changes
Cargo.lock, for example #86 and #101 in the look-and-feel stack.master's next scheduled audit will fail too: its last run, at 06:28 UTC, predates the advisory in the database.Change
cargo update -p ctutils --precise 0.4.5. Onlyctutilschanges inCargo.lock; itscmovdependency stays at 0.5.4. No source changes. Adds a changelog line in the style of the previous RustSec fix.Try it on staging
Nothing to try on staging: this changes only a transitive dependency.
Checks
cargo fmt --check,cargo clippy --locked --all-targets -- -D warnings,cargo machete --with-metadata,cargo test --locked(143 unit and 126 integration tests), andpython3 scripts/check-coverage.pyall pass.cargo audit(cargo-audit 0.22) reports no vulnerabilities. Four warnings remain, as onmasterbefore the advisory:zbus_names,zvariant, andzvariant_deriveare unmaintained, andclipboard-win5.4.1 is yanked. The workflow treats these as informational and doesn't fail on them.src/andtests/are unchanged.