{"id":"ghsa-ghsa-c8m5-c952-6cm4","seq":1708776,"kind":"advisory","title":"Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs","url":"https://github.com/advisories/GHSA-c8m5-c952-6cm4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-c8m5-c952-6cm4","summary":"影響: rust:rustls < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2\nFormatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive. Details Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit [key-material redaction policy](https://gith…","severity":"medium","techs":["rust"],"cves":[],"tags":["GHSA-c8m5-c952-6cm4","rustls","rustls"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T16:08:47.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}