Bug 2568765 (CVE-2026-123609)

Summary: CVE-2026-123609 rustls: rustls: Information disclosure via debug formatting of client session values
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, aprice, asdas, bbrownin, blitton, brasmith, cochase, dbosanac, doconnor, dpaolell, dranck, eborisov, ehelms, gbenhaim, gotiwari, hasun, hoberger, jcantril, jdelft, jfula, jhorak, jlanda, jowilson, jpasqual, jreimann, jsamir, jupierce, juwatts, kshier, lball, lblicha, lgarciaa, lpele, mbarnett, mbiarnes, mdessi, mhulan, mrizzi, mvyas, ngough, niyer, nyancey, oezr, ogajduse, ometelka, osousa, pcattana, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rchan, rekumar, rhel-process-autobot, rojacob, sarad, sghai, sidsharm, simaishi, smallamp, sprizend, stcannon, suppawar, syedriko, twaugh, veshanka, vlaad, vvoronko, watson-tool-maintainers, xdharmai, yguenane, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in rustls. An information disclosure vulnerability occurs when client session values are formatted using debug logging, exposing sensitive cryptographic key material such as Transport Layer Security (TLS) master secrets and resumption pre-shared keys (PSKs). If an application or custom session storage implementation logs these values, an attacker with access to the log files can obtain secret keys, potentially compromising encrypted communication sessions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-08 02:02:08 UTC 
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.