Stream: git-wasmtime

Topic: wasmtime / issue #14892 RUSTSEC-2026-0382: Certificate ve...

Wasmtime GitHub notifications bot (Oct 21 2026 at 00:13):

github-actions[bot] opened issue #14892:

Certificate verification may accept distrusted intermediates

Details
Package	rustls-webpki
Version	0.103.15
URL	https://github.com/rustls/webpki/pull/546
Date	2026-10-20
Patched versions	>=0.103.16, <0.104.0-alpha.1,>=0.104.0-alpha.8

Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys when the configured trust anchors allow such paths.
The private keys corresponding to these intermediates are now well known.

Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.

See advisory page for additional details.

Wasmtime GitHub notifications bot (Oct 21 2026 at 17:01):

pchickey closed issue #14892:

Certificate verification may accept distrusted intermediates

Details
Package	rustls-webpki
Version	0.103.15
URL	https://github.com/rustls/webpki/pull/546
Date	2026-10-20
Patched versions	>=0.103.16, <0.104.0-alpha.1,>=0.104.0-alpha.8

Affected versions may accept certificate paths containing distrusted emSign
intermediate public keys when the configured trust anchors allow such paths.
The private keys corresponding to these intermediates are now well known.

Versions 0.103.16 and 0.104.0-alpha.8 reject paths containing these public keys.

See advisory page for additional details.

Last updated: Oct 31 2026 at 23:03 UTC