fix(servo): gate vulnerable RSA private operations

2026-07-10 01:06:48 -04:00
parent 670f7abe60
commit e085174b89
67 changed files with 10535 additions and 21 deletions
@@ -0,0 +1,13 @@
+# ELY private-operation gate
+
+Source: `rsa 0.10.0-rc.18` from crates.io.
+
+Source archive SHA-256: `30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf`.
+
+ELY adds and enables the `private-key-operations-disabled` default feature. The shared
+`rsa_decrypt` primitive returns before every private exponent operation. This gates RSA
+decrypt and signing while preserving public-key encryption and verification.
+The vendored test source also removes one trailing space for repository hygiene.
+
+The gate mitigates `RUSTSEC-2023-0071` while the advisory has no patched release.
+Remove this vendor patch after RustCrypto publishes a complete constant-time fix.