GHSA-6g7w-8wpp-frhj and CVE-2024-32650 don't make it clear that async rustls servers aren't susceptible about rustls HOT 2 CLOSED

The new text is fantastic, thanks!

from rustls.

Hi there,

Thanks for opening an issue about this. I agree this point could have been clearer, sorry about the confusion.

Would it be possible for the GHSA and CVE to be updated to make that clear? Thanks!

I've edited the GHSA entry to be more explicit about tokio-rustls (spelled correctly this time) not being affected.

I don't know if the assigned CVE text is mutable (or at least I don't know how to go about getting it updated if it is!). Hopefully the combination of the Rustsec advisory, the updated GHSA, the release notes, and this issue will be enough to dispel any lingering confusion.

from rustls.