[PR #476] [MERGED] security: Disable TLS1.0/1.1 for ureq-native-tls #482

New issue

Closed

opened 2026-02-27 20:24:53 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 20:24:53 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/ramsayleung/rspotify/pull/476
Author: @Property404
Created: 4/3/2024
Status: ✅ Merged
Merged: 4/9/2024
Merged by: @ramsayleung

Base: master ← Head: Property404/dont_use_old_tls

📝 Commits (1)

0d42dca security: Disable TLS1.0/1.1 for ureq-native-tls

📊 Changes

1 file changed (+5 additions, -1 deletions)

View changed files

📝 rspotify-http/src/ureq.rs (+5 -1)

📄 Description

Description

Explicity opt-out of old TLS versions when using the ureq-native-tls feature. Rust-native-tls enables these outdated TLS versions by default

Motivation and Context

TLS 1.0 and 1.1 have been deprecated since 2021. Enabling TLS 1.0/1.1 has possibility (albeit a low one) of introducing a security vulnerability. All modern clients and servers have supported 1.2 for years, so this should be an issue

Dependencies

None

Type of change

[ *] Bug fix (non-breaking change which fixes an issue)

How has this been tested?

Locally only, through cargo-test and cargo-clippy

Is this change properly documented?

Added a short comment explaining reasoning

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/ramsayleung/rspotify/pull/476 **Author:** [@Property404](https://github.com/Property404) **Created:** 4/3/2024 **Status:** ✅ Merged **Merged:** 4/9/2024 **Merged by:** [@ramsayleung](https://github.com/ramsayleung) **Base:** `master` ← **Head:** `Property404/dont_use_old_tls` --- ### 📝 Commits (1) - [`0d42dca`](https://github.com/ramsayleung/rspotify/commit/0d42dca69d7a4547f62659f5a7e27daa226ec1a3) security: Disable TLS1.0/1.1 for ureq-native-tls ### 📊 Changes **1 file changed** (+5 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `rspotify-http/src/ureq.rs` (+5 -1) </details> ### 📄 Description ## Description Explicity opt-out of old TLS versions when using the ureq-native-tls feature. Rust-native-tls enables these outdated TLS versions by default ## Motivation and Context TLS 1.0 and 1.1 have been deprecated since 2021. Enabling TLS 1.0/1.1 has possibility (albeit a low one) of introducing a security vulnerability. All modern clients and servers have supported 1.2 for years, so this should be an issue ## Dependencies None ## Type of change - [ *] Bug fix (non-breaking change which fixes an issue) ## How has this been tested? Locally only, through cargo-test and cargo-clippy ## Is this change properly documented? Added a short comment explaining reasoning --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>