Track RSA Marvin Attack advisory (RUSTSEC-2023-0071)

[Detair]

Problem

deny.toml (line 18) suppresses advisory RUSTSEC-2023-0071 for the rsa crate, which is a transitive dependency of openidconnect.

The Marvin Attack is a timing side-channel attack against RSA PKCS#1 v1.5 decryption. No safe upgrade is currently available.

Current Mitigation

• The rsa crate is only used transitively by openidconnect for OIDC token verification
• OIDC tokens use RSA for signature verification (not decryption), which is not directly affected by Marvin
• The advisory is suppressed with a comment explaining the situation

Action Items

• Monitor openidconnect crate for updates that bump rsa to a fixed version
• Re-evaluate when rsa >= 0.10 is released (expected to fix the issue)
• Remove the suppression from deny.toml once a safe version is available

References

• https://rustsec.org/advisories/RUSTSEC-2023-0071
• modpow implementation is not constant-time RustCrypto/RSA#19

Severity

Low — the attack vector (RSA decryption timing) doesn't apply to our usage (signature verification).

[Detair]

Status check (2026-03-18)

Still blocked. No actionable change since issue was opened.

• rsa latest stable: 0.9.10 — RUSTSEC-2023-0071 remains unpatched
• rsa 0.10.0 is in RC (0.10.0-rc.8), not yet stable
• openidconnect 4.0.1 pins rsa ^0.9, cannot use 0.10.x
• jsonwebtoken 10.3.0 also depends on rsa 0.9.x in our lockfile
• Our exposure remains low: we use RSA for OIDC signature verification only, not decryption (the Marvin Attack vector)
• deny.toml suppression is still necessary and correct

Will re-check when rsa 0.10 reaches stable release.