3.7
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The fix for these advisories is rustls 0.23.46. chaos-tproxy 0.5.7 declares rustls 0.20.4 directly, alongside tokio-rustls 0.23.4, which itself depends on the rustls 0.20 line. Its HTTP stack is built on two personal forks pulled in as git dependencies - hyper from github.com/Andrewmatilde/hyper.git, carrying a non-upstream error_return feature that the application depends on, and hyper-rustls from github.com/Andrewmatilde/hyper-rustls.git - both built against that same rustls generation. Moving to the 0.23 line is therefore not a version bump but a replacement of the project's TLS and HTTP stack, including forks that only upstream can regenerate. Upstream's most recent release, v0.5.7, and their default branch both still declare rustls 0.20.4. This will be resolved when upstream migrates to a fixed rustls release.
Status