Skip to content

Update module github.com/refraction-networking/utls to v1.7.0 [SECURITY] #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update module github.com/refraction-networking/utls to v1.7.0 [SECURITY] #16

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link

@renovate renovate bot commented Apr 27, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
github.com/refraction-networking/utls v1.3.2 → v1.7.0 age confidence

GitHub Vulnerability Alerts

GHSA-pmc3-p9hx-jq96

Description

Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version (e.g., TLS 1.2) by modifying the ClientHello message to exclude the SupportedVersions extension, causing the server to respond with a TLS 1.2 ServerHello (along with a downgrade canary in the ServerHello random field). Because utls did not check the downgrade canary in the ServerHello random field, clients would accept the downgraded connection without detecting the attack. This attack could also be used by an active network attacker to fingerprint utls connections.

Fix Commit or Pull Request

refraction-networking/utls#337, specifically refraction-networking/utls@f889276

References

Release Notes

refraction-networking/utls (github.com/refraction-networking/utls)

v1.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.6.7...v1.7.0

v1.6.7: Allow inspecting Client Hello before locking Session/PSK

Compare Source

What's Changed

  • Allow BuildHandshakeState to inspect ClientHello before setting SessionTicket/PSK by @​adotkhan in #​301

Full Changelog: refraction-networking/utls@v1.6.6...v1.6.7

v1.6.6: Hotfix: QUIC must not send non-empty session ID by RFC

Compare Source

What's Changed

Full Changelog: refraction-networking/utls@v1.6.5...v1.6.6

v1.6.5: Popular Firefox 120 parrot and deps update

Compare Source

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.6.4...v1.6.5

v1.6.4: bugfix: UConn incorrectly inherits Conn methods

Compare Source

What's Changed

Full Changelog: refraction-networking/utls@v1.6.3...v1.6.4

v1.6.3: Cryptographically Secured Shuffle

Compare Source

Don't panic! This does not cause any significant security concern, since modern platforms are doing fine with limited randomness from math/rand. This patch is for some much restrictive platforms such as WebAssembly -- on which math/rand may generate deterministic output (e.g., same random number series from each cold start).

What's Changed

Full Changelog: refraction-networking/utls@v1.6.2...v1.6.3

v1.6.2: Dependency and Upstream Update

Compare Source

What's Changed

Full Changelog: refraction-networking/utls@v1.6.1...v1.6.2

v1.6.1: Hotfix: kyberslash2

Compare Source

Security Warning

This is a security update fixing kyberslash2, a timing side-channel attack against CIRCL library used by uTLS.

What's Changed

Full Changelog: refraction-networking/utls@v1.6.0...v1.6.1

v1.6.0: One step closer to ECH

Compare Source

What's New

  • We now have GREASE ECH parrots (Chrome 120, Firefox 120) available!

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.5.4...v1.6.0

v1.5.4: Maintenance: bugfix and undo breaking API

Compare Source

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.5.3...v1.5.4

v1.5.3: Hotfix: secondary key share

Compare Source

What's Changed

  • fix: secondary keyshares may be lost after overriding keySharesParams by @​gaukas in #​238

Full Changelog: refraction-networking/utls@v1.5.2...v1.5.3

v1.5.2: bugfix

Compare Source

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.5.0...v1.5.2

v1.5.1

Compare Source

v1.5.0: Post-Quantum and Session Resumption

Compare Source

What's Changed

A big shout out to @​3andne for spending time on major refactoring/revision in the Session Resumption for both TLS 1.2 (SessionTicket-based) and TLS 1.3 (PreSharedKey-based)!

New API

type ISessionTicketExtension interface {
	TLSExtension

	// If false is returned, utls will invoke `InitializeByUtls()` for the necessary initialization.
	Initializable

	// InitializeByUtls is invoked when IsInitialized() returns false.
	// It initializes the extension using a real and valid TLS 1.2 session.
	InitializeByUtls(session *SessionState, ticket []byte)

	GetSession() *SessionState

	GetTicket() []byte
}

// SetSessionTicket sets the session ticket extension.
// If extension is nil, this will be a no-op.
func (uconn *UConn) SetSessionTicketExtension(sessionTicketExt ISessionTicketExtension)

type PreSharedKeyExtension interface {
	// TLSExtension must be implemented by all PreSharedKeyExtension implementations.
	TLSExtension

	// If false is returned, utls will invoke `InitializeByUtls()` for the necessary initialization.
	Initializable

	SetOmitEmptyPsk(val bool)

	// InitializeByUtls is invoked when IsInitialized() returns false.
	// It initializes the extension using a real and valid TLS 1.3 session.
	InitializeByUtls(session *SessionState, earlySecret []byte, binderKey []byte, identities []PskIdentity)

	// GetPreSharedKeyCommon retrieves the final PreSharedKey-related states as defined in PreSharedKeyCommon.
	GetPreSharedKeyCommon() PreSharedKeyCommon

	// PatchBuiltHello is called once the hello message is fully applied and marshaled.
	// Its purpose is to update the binders of PSK (Pre-Shared Key) identities.
	PatchBuiltHello(hello *PubClientHelloMsg) error

	mustEmbedUnimplementedPreSharedKeyExtension() // this works like a type guard
}

// SetPskExtension sets the psk extension for tls 1.3 resumption. This is a no-op if the psk is nil.
func (uconn *UConn) SetPskExtension(pskExt PreSharedKeyExtension) error

Full Changelog: refraction-networking/utls@v1.4.3...v1.5.0

v1.4.3: Buggy versions retracted

Compare Source

Retract v1.4.0, v1.4.1 for a breaking change made by crypto/tls in client handshake. This tag contains no code change from v1.4.2 since v1.4.2 patches the exact bug in the retracted versions.

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.4.2...v1.4.3

v1.4.2: Hotfix: ClientSessionCache

Compare Source

Provide a dirty fix for a bug(?) triggered when Config.ClientSessionCache is nil and session_ticket is received from a server.

v1.4.1: Go above and beyond

Compare Source

Security Fix

What's New

  • Feature: QUIC Transport from Go 1.21
  • Oldest supported Go version: 1.19 1.20
    • Go 1.19 is retiring :( sorry children

What's Changed

New Contributors

Full Changelog: refraction-networking/utls@v1.3.3...v1.4.1

v1.4.0

Compare Source

v1.3.3: Compatibility and Optimization

Compare Source

What's Changed

Full Changelog: refraction-networking/utls@v1.3.2...v1.3.3

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Author

renovate bot commented Apr 27, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 6 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.20 -> 1.24.0
golang.org/x/net v0.10.0 -> v0.38.0
github.com/andybalholm/brotli v1.0.5 -> v1.0.6
github.com/klauspost/compress v1.16.5 -> v1.17.4
golang.org/x/crypto v0.9.0 -> v0.36.0
golang.org/x/sys v0.8.0 -> v0.31.0
golang.org/x/text v0.9.0 -> v0.23.0

@renovate renovate bot force-pushed the renovate/go-github.com-refraction-networking-utls-vulnerability branch from 8476065 to 0814297 Compare May 10, 2025 00:11
@renovate renovate bot force-pushed the renovate/go-github.com-refraction-networking-utls-vulnerability branch from 0814297 to 777e7ea Compare August 11, 2025 19:58
@renovate renovate bot force-pushed the renovate/go-github.com-refraction-networking-utls-vulnerability branch from 777e7ea to 5a2b6dd Compare August 14, 2025 23:56
@renovate
Copy link
Author

renovate bot commented Dec 15, 2025

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 6 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.20 -> 1.24.0
golang.org/x/net v0.10.0 -> v0.38.0
github.com/andybalholm/brotli v1.0.5 -> v1.0.6
github.com/klauspost/compress v1.16.5 -> v1.17.4
golang.org/x/crypto v0.9.0 -> v0.36.0
golang.org/x/sys v0.8.0 -> v0.31.0
golang.org/x/text v0.9.0 -> v0.23.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants