Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
影響: rust:rustls < 0.23.46 → 0.23.46, rust:rustls >= 0.24.0-dev.1, < 0.24.0-dev.2 → 0.24.0-dev.2
Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive. Details Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit [key-material redaction policy](https://gith…
| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 01:08, GitHub Advisory Database에서 "Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Rust.