[cpu]

Here's a first crack at advisories for the emudhra situation. This is perhaps a little bit unique in that it's not strictly a failure in the listed crates, but we think a RUSTSEC advisory will help move the ecosystem towards taking the required updates.

Affected crate(s)

• rustls-webpki
• webpki-roots
• webpki-root-certs

Links to upstream issue(s) or PR(s)

rustls/webpki#546
rustls/webpki-roots#133
https://emudhra.we-have-a-problem.com/
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Severity

The private keys corresponding to the affected intermediate certificates are trivially available. In absence of another source of revocation data, trusting these intermediates (or the roots that issued them), may result in bypass of TLS authentication and risk of person-in-the-middle attacks.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate