Repository navigation
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1365 +/- ##
=======================================
Coverage 91.32% 91.32%
=======================================
Files 190 190
Lines 22982 22982
=======================================
Hits 20989 20989
Misses 1993 1993 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
tarcieri
added a commit
to rustsec/advisory-db
that referenced
this pull request
Oct 23, 2026
This advisory covers issues fixed in v0.7.6: RustCrypto/crypto-bigint#1365
tarcieri
added a commit
to rustsec/advisory-db
that referenced
this pull request
Oct 24, 2026
This advisory covers issues fixed in v0.7.6: RustCrypto/crypto-bigint#1365
This was referenced Oct 24, 2026
3 tasks
jeffkit
pushed a commit
to jeffkit/recursive
that referenced
this pull request
Oct 24, 2026
…0.5.5 时序可变性族(无范围内补丁) supply-chain job 红(run 于 e0c57e6 push):crypto-bigint 0.5.5 非常数时间运算时序可变性(2026-10-24 新公告,RustCrypto/crypto-bigint#1365),解法=升 >=0.7.6 跨大版本,而依赖方 aws-sigv4 1.5.1 / elliptic-curve 0.13.8 均 pin ^0.5——**升级通道不可用,进豁免清单**(audit.toml 头部原则:能 update 的不进清单;本条属「无 patched 可锁」场景,与 zip 0367-0369 同类)。暴露面:纯传递依赖零直接调用,AWS SigV4/P-256 均在成熟库内部,无自建常数时间面。解禁条件=依赖方发布支持 0.7 的版本并升级。与落地内容(e0c57e6 纯 docs)无关,纯 advisory-db 漂移。Policy-ack: jeffkit 2026-10-19
2 of 4 tasks
Aelieth
added a commit
to Aelieth/kerber-rust
that referenced
this pull request
Oct 24, 2026
crypto-bigint 0.7.5 carries RUSTSEC-2026-0387: timing variability in operations meant to be constant-time (RustCrypto/crypto-bigint#1365), on the paths that rely on it for constant-time arithmetic -- PKINIT's Diffie-Hellman, RSA and ECDSA, and SPAKE's curves. Update it to 0.7.6, which fixes them, in the root and fuzz lockfiles; the transitive ctutils constant-time helper moves 0.4.4 -> 0.4.5 with it. The dependency requirement stays "0.7", so there is no manifest, API or MSRV change. Move the cargo-vet exemptions for both crates to the new versions; they stay exempted pending the 1.2 supply-chain audit. Record a Security CHANGELOG bullet.
This was referenced Oct 24, 2026
4 tasks done
This was referenced Oct 26, 2026
6 of 16 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added
ZeroizeforEncodedUint(#1342)Changed
floor_sqrt,checked_sqrtimplementation (#1312)ctutilsto v0.4.4; MSRV 1.87 (#1350, #1359)Fixed
BoxedUintGCD with mixed-precision zero operands (#1291)wrapping_squarefor larger integers (#1309)Uint::try_sub_with_carry(#1354)Security
UintRef::PartialEqconstant-time and implementPartialOrd/Ord(#1311)BoxedMontyForm::invert(#1355)borrowing_subconstant-timeness; usecargo checkct(#1358)div_rem,nlimbs, and Montgomery mul (#1360)