chore(deps): update rust crate openssl to v0.10.60 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
openssl	workspace.dependencies	patch	0.10.57 -> 0.10.60

GitHub Vulnerability Alerts

GHSA-xphf-cx8h-7q9g

This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.

Use of this function should be replaced with X509StoreRef::all_certificates.

---

Release Notes

sfackler/rust-openssl (openssl)

v0.10.60

Compare Source

What's Changed

• Correct off-by-one in minimum output buffer size computation by @​alex in https://github.com/sfackler/rust-openssl/pull/2088
• Expose a few more (bad) ciphers in cipher::Cipher by @​alex in https://github.com/sfackler/rust-openssl/pull/2084
• add temp key bindings by @​jmayclin in https://github.com/sfackler/rust-openssl/pull/2076
• Expose ChaCha20 on LibreSSL by @​alex in https://github.com/sfackler/rust-openssl/pull/2093
• Revert "Correct off-by-one in minimum output buffer size computation" by @​alex in https://github.com/sfackler/rust-openssl/pull/2090
• Added update_unchecked to symm::Crypter by @​alex in https://github.com/sfackler/rust-openssl/pull/2100
• fixes #​2096 -- deprecate X509StoreRef::objects, it is unsound by @​alex in https://github.com/sfackler/rust-openssl/pull/2099
• Don't leak when overwriting ex data by @​sfackler in https://github.com/sfackler/rust-openssl/pull/2102
• Release openssl v0.10.60 and openssl-sys v0.9.96 by @​alex in https://github.com/sfackler/rust-openssl/pull/2104

Full Changelog: sfackler/rust-openssl@openssl-v0.10.59...openssl-v0.10.60

v0.10.59

Compare Source

What's Changed

• Add binding to NID of Chacha20-Poly1305 cipher by @​Arnavion in https://github.com/sfackler/rust-openssl/pull/2081
• Fixed cfg for RSA_PSS by @​alex in https://github.com/sfackler/rust-openssl/pull/2079
• fixes #​2050 -- build and test on libressl 3.8.2 by @​alex in https://github.com/sfackler/rust-openssl/pull/2082
• Release openssl v0.10.59 and openssl-sys v0.9.95 by @​alex in https://github.com/sfackler/rust-openssl/pull/2083

New Contributors

• @​Arnavion made their first contribution in https://github.com/sfackler/rust-openssl/pull/2081

Full Changelog: sfackler/rust-openssl@openssl-v0.10.58...openssl-v0.10.59

v0.10.58

Compare Source

What's Changed

• LibreSSL 3.8.1 support by @​alex in https://github.com/sfackler/rust-openssl/pull/2035
• Update vendored version to openssl 3 by @​amousset in https://github.com/sfackler/rust-openssl/pull/1925
• Test against 3.2.0-alpha1 by @​sfackler in https://github.com/sfackler/rust-openssl/pull/2037
• Removed reference to non-existent method by @​alex in https://github.com/sfackler/rust-openssl/pull/2039
• Bump CI to 1.1.1w by @​sfackler in https://github.com/sfackler/rust-openssl/pull/2040
• [openssl-sys] Add X509_check_{host,email,ip,ip_asc} fns by @​jgallagher in https://github.com/sfackler/rust-openssl/pull/2042
• Expose CBC mode for several more (bad) ciphers by @​alex in https://github.com/sfackler/rust-openssl/pull/2045
• Expose two additional Pkey IDs by @​alex in https://github.com/sfackler/rust-openssl/pull/2046
• Add support for CRL extensions and the Authority Information Access e… by @​AdmiralGT in https://github.com/sfackler/rust-openssl/pull/2003
• Fix clippy warnings produced by newer Rust by @​wiktor-k in https://github.com/sfackler/rust-openssl/pull/2052
• Use osslconf on BoringSSL by @​alex in https://github.com/sfackler/rust-openssl/pull/2056
• Make X509_ALGOR opaque for LibreSSL by @​botovq in https://github.com/sfackler/rust-openssl/pull/2060
• Don't ignore ECDSA tests without GF2m support by @​botovq in https://github.com/sfackler/rust-openssl/pull/2061
• Clarify 'possible LibreSSL bug' by @​botovq in https://github.com/sfackler/rust-openssl/pull/2062
• Enable BN_mod_sqrt() for upcoming LibreSSL 3.8.2 by @​botovq in https://github.com/sfackler/rust-openssl/pull/2063
• Enable SHA-3 for LibreSSL 3.8.0 by @​botovq in https://github.com/sfackler/rust-openssl/pull/2064
• Remove DH_generate_parameters for LibreSSL 3.8.2 by @​botovq in https://github.com/sfackler/rust-openssl/pull/2065
• Use EVP_MD_CTX_{new,free}() in LibreSSL 3.8.2 by @​botovq in https://github.com/sfackler/rust-openssl/pull/2067
• Enable HKDF support for LibreSSL >= 3.6.0 by @​botovq in https://github.com/sfackler/rust-openssl/pull/2066
• Two build script fixes for LibreSSL by @​botovq in https://github.com/sfackler/rust-openssl/pull/2068
• Respect OPENSSL_NO_OCB on AES functions by @​GuyLewin in https://github.com/sfackler/rust-openssl/pull/2070
• Support OPENSSL_NO_SCRYPT by @​GuyLewin in https://github.com/sfackler/rust-openssl/pull/2071
• Bump 3.2.0 beta by @​sfackler in https://github.com/sfackler/rust-openssl/pull/2073
• add security level bindings by @​jmayclin in https://github.com/sfackler/rust-openssl/pull/2074
• Release openssl v0.10.58 and openssl-sys v0.9.94 by @​alex in https://github.com/sfackler/rust-openssl/pull/2078

New Contributors

• @​amousset made their first contribution in https://github.com/sfackler/rust-openssl/pull/1925
• @​jgallagher made their first contribution in https://github.com/sfackler/rust-openssl/pull/2042
• @​AdmiralGT made their first contribution in https://github.com/sfackler/rust-openssl/pull/2003
• @​botovq made their first contribution in https://github.com/sfackler/rust-openssl/pull/2060
• @​GuyLewin made their first contribution in https://github.com/sfackler/rust-openssl/pull/2070
• @​jmayclin made their first contribution in https://github.com/sfackler/rust-openssl/pull/2074

Full Changelog: sfackler/rust-openssl@openssl-v0.10.57...openssl-v0.10.58

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[rustbot]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @epage (or someone else) soon.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

• @rustbot author: the review is finished, PR author should check the comments and take action accordingly
• @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

[weihanglo]

See #13101.
Closing

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (0.10.57). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.