| Version | Supported |
|---|---|
| 0.9.x | ✅ |
| < 0.9 | ❌ |
Only the latest minor release receives security patches. Upgrade to the latest version for all fixes.
Please do not report security vulnerabilities through public GitHub issues.
Instead, please report them via:
- GitHub Private Vulnerability Reporting: Report a vulnerability (preferred)
- Email: devitway@gmail.com
- Telegram: @devitway_pavel (private message)
- Type of vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Initial response: within 48 hours
- Status update: within 7 days
- Fix timeline: depends on severity
| Severity | Description | Response |
|---|---|---|
| Critical | Remote code execution, auth bypass | Immediate fix |
| High | Data exposure, privilege escalation | Fix within 7 days |
| Medium | Limited impact vulnerabilities | Fix in next release |
| Low | Minor issues | Scheduled fix |
The following RustSec advisories are excluded from cargo audit in CI
with documented rationale:
| Field | Value |
|---|---|
| Advisory | RUSTSEC-2023-0071 |
| Crate | rsa 0.9.x (transitive via jsonwebtoken) |
| Attack | Marvin Attack — timing side-channel on RSA PKCS#1 v1.5 decryption |
| NORA usage | JWT signature verification only (OIDC workload identity) |
| Applicable | No — NORA calls rsa::verify, never rsa::decrypt |
| Upstream fix | None available; rsa crate maintainers have not patched |
Why RS256 is required: GitHub Actions and GitLab CI OIDC providers sign
their workload identity tokens with RS256. NORA must verify these signatures
to support keyless CI/CD authentication. The rsa crate cannot be removed
from the dependency tree without breaking OIDC integration.
Mitigations in place:
- Algorithm whitelist per OIDC provider (
algorithmsconfig field) - Default allowed algorithms: RS256, ES256 (EdDSA ready when providers adopt it)
- Symmetric algorithms (HS256/384/512) rejected globally
ed25519-dalekalready compiled in viajsonwebtokenrust_cryptofeature
Transitive dependency flagged as unmaintained. No fix available, no security impact — the crate is functioning correctly.
When deploying NORA:
- Enable authentication - Set
NORA_AUTH_ENABLED=true - Use HTTPS - Put NORA behind a reverse proxy with TLS
- Limit network access - Use firewall rules
- Regular updates - Keep NORA updated to latest version
- Secure credentials - Use strong passwords, rotate tokens
We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities in our release notes and CHANGELOG, unless the reporter requests anonymity.
If you have previously reported a vulnerability and would like to be credited, please let us know.