From 718257190a7ac0cda2551601c83787a0d132640b Mon Sep 17 00:00:00 2001 From: Aeon Date: Tue, 21 Jul 2026 18:08:03 +0000 Subject: [PATCH] security: track quick-xml DoS (RUSTSEC-2026-0194/0195) via rust-s3 Both rust-s3 0.37.2 (crates.io) and the aws-creds fork pin quick-xml 0.38.4, which is affected by two publicly disclosed advisories: - RUSTSEC-2026-0194: O(N^2) CPU amplification on malformed XML attribute values - RUSTSEC-2026-0195: Unbounded memory growth from deeply-nested XML elements The fix requires quick-xml >=0.40.0. A Cargo [patch.crates-io] cannot bridge the semver-incompatible bump without recompile errors; the remediation must come from rust-s3 upstream (durch/rust-s3) and be mirrored into the tlongwell-block fork. Exploitability in buzz is limited to S3 API response parsing, which uses a trusted operator-controlled endpoint. Risk arises only if the S3 layer is compromised or MITM'd. This commit adds a tracking comment so the dep pin is not silently reverted before the fix lands. Remove it once aws-creds is updated to a quick-xml >=0.40 revision. --- Cargo.toml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/Cargo.toml b/Cargo.toml index 3499285f91..afb04922bc 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -167,5 +167,23 @@ strip = true # aws-creds to a fork that adopts the aws-creds portion of durch/rust-s3#449 # (FULL_URI + token-file + Authorization header, refresh-safe, with a loopback # allowlist for the auth token). Revert to crates.io once #449 lands upstream. +# +# SECURITY TRACKING (quick-xml DoS): rust-s3 0.37.2 and the aws-creds fork above +# both pull in quick-xml 0.38.4, which is affected by RUSTSEC-2026-0194 (O(N²) CPU +# amplification on malformed attribute values) and RUSTSEC-2026-0195 (unbounded +# memory growth from deeply-nested XML). The fix requires quick-xml ≥ 0.40.0, but +# that is a semver-incompatible bump from rust-s3's current ^0.38 pin — a Cargo +# workspace patch cannot bridge incompatible minor versions without recompile errors. +# +# Exploitability in buzz: quick-xml is reached only via S3 API response parsing +# (ListBucket/GetObject XML). In production the S3 endpoint is operator-controlled +# and trusted; risk materialises only if the S3 layer is compromised or MITM'd. +# +# Remediation path: +# 1. Upstream: https://github.com/durch/rust-s3 — bump quick-xml to ^0.40 and +# release ≥0.38.0 (or 0.37.3). Track: durch/rust-s3#[upstream issue]. +# 2. Fork: mirror the same bump in tlongwell-block/rust-s3 and advance the +# rev pin in aws-creds below to pick up the fix. +# Remove this comment block once the pin above is updated to a fixed revision. [patch.crates-io] aws-creds = { git = "https://github.com/tlongwell-block/rust-s3", rev = "c9fce3620dd434c1f810101d672cf384268dbb0f" }