vcswatch reports that
this package seems to have a new changelog entry (version
0.23.40+ds-2, distribution
UNRELEASED) and new commits
in its VCS. You should consider whether it's time to make
an upload.
1 issue left for the package maintainer to handle:
CVE-2024-32650:
(needs triaging)
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
Among the 12 debian patches
available in version 0.23.40+ds-1 of the package,
we noticed the following issues:
4 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/r/rust-rustls.png){kind=link}