openssl 0.10.82

Source: https://github.com/rust-openssl/rust-openssl
Artifact scanned: openssl-0.10.82.crate (crate · 309.5 KB · SHA-256 4de8111e94a5…)
Compared with: openssl-0.10.81.crate (0 signals introduced since)
Files: 62 scanned, 50 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 31 info
Scan time: 8.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-11-01 21:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review encoding-hex src/aes.rs:37:13

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
let plaintext = b"\x12\x34\x56\x78\x90\x12\x34\x56\x12\x34\x56\x78\x90\x12\x34\x56";
let mut iv = *b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\
```
dismissed LLM, confidence 0.93 Hex byte-literal AES key, plaintext and IV used as test input.
Reasoning
The bytes are the standard AES test vector input, a sequential 0x00 to 0x0F key and a fixed plaintext. This is ordinary cryptographic test data in a rust-openssl style test file, and the unsafe elevation does not change that.
info ~~critical~~ → info by review encoding-hex src/aes.rs:39:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
let plaintext = b"\x12\x34\x56\x78\x90\x12\x34\x56\x12\x34\x56\x78\x90\x12\x34\x56";
let mut iv = *b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\
                \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F";
```
dismissed LLM, confidence 0.93 Continuation of AES test-vector IV and plaintext byte literals.
Reasoning
This is the continuation of the same AES test-vector byte literals (plaintext and IV). The escaped-hex form is how test vectors are normally written in Rust, and nothing here executes or hides code.
info ~~critical~~ → info by review encoding-hex src/aes.rs:40:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
let mut iv = *b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\
                \x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F";

 let key = AesKey::new_encrypt(key).unwrap();
```
dismissed LLM, confidence 0.93 AES-IGE IV byte literal in a known-answer test.
Reasoning
The IV bytes are a sequential test pattern used to initialise an AES-IGE test. This is a known-answer test, not obfuscation.
info ~~critical~~ → info by review encoding-hex src/aes.rs:45:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
 aes_ige(plaintext, &mut output, &key, &mut iv, Mode::Encrypt);
 assert_eq!(output, *b"\xa6\xad\x97\x4d\x5c\xea\x1d\x36\xd2\xf3\x67\x98\x09\x07\xed\x32");
```"#
)]
```
dismissed LLM, confidence 0.93 Expected ciphertext byte array in an AES-IGE assertion.
Reasoning
This asserts the AES-IGE output against an expected ciphertext byte array. That is a standard known-answer test assertion with no runtime decoding or execution.

info encoding-hex src/aes.rs:54:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//!
//! let kek = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
//! let key_to_wrap = b"\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF";
//!

info encoding-hex src/aes.rs:55:25

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//! let kek = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
//! let key_to_wrap = b"\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xAA\xBB\xCC\xDD\xEE\xFF";
//!
//! let enc_key = AesKey::new_encrypt(kek).unwrap();

info encoding-hex src/cipher_ctx.rs:13:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//! let data = b"Some Crypto Text";
//! let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
//! let iv = b"\x00\x01\x02\x03\x04\x05\x06\x07\x00\x01\x02\x03\x04\x05\x06\x07";
//!

info encoding-hex src/cipher_ctx.rs:24:11

22 consecutive `\xNN` escapes (entropy 4.4 bits/byte) (in comment) (raw pass, confidence 0.39)

//! assert_eq!(
//!     b"\xB4\xB9\xE7\x30\xD6\xD6\xF7\xDE\x77\x3F\x1C\xFF\xB3\x3E\x44\x5A\x91\xD7\x27\x62\x87\x4D\
//!       \xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1",
//!     &ciphertext[..],

info encoding-hex src/cipher_ctx.rs:37:18

20 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (in comment) (raw pass, confidence 0.39)

//! let cipher = Cipher::aes_128_cbc();
//! let data = b"\xB4\xB9\xE7\x30\xD6\xD6\xF7\xDE\x77\x3F\x1C\xFF\xB3\x3E\x44\x5A\x91\xD7\x27\x62\
//!              \x87\x4D\xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1";
//! let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";

info encoding-hex src/cipher_ctx.rs:39:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//!              \x87\x4D\xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1";
//! let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
//! let iv = b"\x00\x01\x02\x03\x04\x05\x06\x07\x00\x01\x02\x03\x04\x05\x06\x07";
//!

info ~~critical~~ → info by review encoding-escape-soup src/dh.rs:340:57

840 consecutive `\xNN` escapes (entropy 7.7 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.80)
```
  assert_eq!(pkey.public_key_to_der().unwrap(), b"\x30\x82\x03\x44\x30\x82\x02\x36\x06\x07\x2a\x86\x48\xce\x3e\x02\x01\x30\x82\x02\x29\x02\x82\x01\x01\x00\xad\x10\x7e\x1e\x91\x23\xa9\xd0\xd6\x60\xfa\xa7\x95\x59\xc5\x1f\xa2\x0d\x64\xe5\x68\x3b\x9f\xd1\xb5\x4b\x15\x97\xb6\x1d\x0a\x75\xe6\xfa\x14\x1d\xf9\x5a\x56\xdb\xaf\x
```
dismissed LLM, confidence 0.90 DER-encoded DH public key bytes used as a test expectation.
Reasoning
The long escape sequence is a DER-encoded DH public key compared against pkey.public_key_to_der() output in a test. The bytes are structured ASN.1 test data, and the high entropy is expected for key material.

info encoding-hex src/encrypt.rs:364:15

12 rows of escape runs, lines 364-375 (first: 21 consecutive `\xNN` escapes (entropy 4.3 bits/byte) (in comment)) (raw pass, confidence 0.39)

    /// # const INPUT: &[u8] = b"\
    /// #     \x26\xa1\xc1\x13\xc5\x7f\xb4\x9f\xa0\xb4\xde\x61\x5e\x2e\xc6\xfb\x76\x5c\xd1\x2b\x5f\
    /// #     \x1d\x36\x60\xfa\xf8\xe8\xb3\x21\xf4\x9c\x70\xbc\x03\xea\xea\xac\xce\x4b\xb3\xf6\x45\

info encoding-hex src/hash.rs:12:18

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (in comment) (raw pass, confidence 0.39)

//! let data = b"\x42\xF4\x97\xE0";
//! let spec = b"\x7c\x43\x0f\x17\x8a\xef\xdf\x14\x87\xfe\xe7\x14\x4e\x96\x41\xe2";
//! let res = hash(MessageDigest::md5(), data)?;
//! assert_eq!(&*res, spec);

info encoding-hex src/hash.rs:213:18

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (in comment) (raw pass, confidence 0.39)

/// let data = [b"\x42\xF4", b"\x97\xE0"];
/// let spec = b"\x7c\x43\x0f\x17\x8a\xef\xdf\x14\x87\xfe\xe7\x14\x4e\x96\x41\xe2";
/// let mut h = Hasher::new(MessageDigest::md5())?;
/// h.update(data[0])?;

info encoding-hex src/hash.rs:459:18

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (in comment) (raw pass, confidence 0.39)

/// let data = b"\x42\xF4\x97\xE0";
/// let spec = b"\x7c\x43\x0f\x17\x8a\xef\xdf\x14\x87\xfe\xe7\x14\x4e\x96\x41\xe2";
/// let res = hash(MessageDigest::md5(), data)?;
/// assert_eq!(&*res, spec);

info encoding-escape-soup src/hash.rs:477:18

30 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (in comment) (raw pass, confidence 0.48)

///
/// let data = b"\x41\x6c\x6c\x20\x79\x6f\x75\x72\x20\x62\x61\x73\x65\x20\x61\x72\x65\x20\x62\x65\x6c\x6f\x6e\x67\x20\x74\x6f\x20\x75\x73";
/// let spec = b"\x49\xd0\x69\x7f\xf5\x08\x11\x1d\x8b\x84\xf1\x5e\x46\xda\xf1\x35";
/// let mut buf = vec![0; 16];

info encoding-hex src/hash.rs:478:18

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (in comment) (raw pass, confidence 0.39)

/// let data = b"\x41\x6c\x6c\x20\x79\x6f\x75\x72\x20\x62\x61\x73\x65\x20\x61\x72\x65\x20\x62\x65\x6c\x6f\x6e\x67\x20\x74\x6f\x20\x75\x73";
/// let spec = b"\x49\xd0\x69\x7f\xf5\x08\x11\x1d\x8b\x84\xf1\x5e\x46\xda\xf1\x35";
/// let mut buf = vec![0; 16];

info encoding-hex src/md_ctx.rs:19:12

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//!     digest,
//!     *b"\x60\x78\x56\x38\x8a\xca\x5c\x51\x83\xc4\xd1\x4d\xc8\xf9\xcc\xf2\
//!        \xa5\x21\xb3\x10\x93\x72\xfa\xd6\x7c\x55\xf5\xc9\xe3\xd1\x83\x19",
//! );

info encoding-hex src/md_ctx.rs:20:12

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//!     *b"\x60\x78\x56\x38\x8a\xca\x5c\x51\x83\xc4\xd1\x4d\xc8\xf9\xcc\xf2\
//!        \xa5\x21\xb3\x10\x93\x72\xfa\xd6\x7c\x55\xf5\xc9\xe3\xd1\x83\x19",
//! );
//! ```

info ~~critical~~ → info by review encoding-base64 src/pkey_ctx.rs:1392:1

base64-like blob (92 bytes over 2 lines, compression ratio 1.12) [elevated: unsafe block in same file] (raw pass, confidence 0.60)
```
        let private_key_pem = "-----BEGIN PRIVATE KEY-----
MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCDJr6nYRbp1FmtcIVdnsdaTTlDD2zbo
mxJ7imIrEg9nIQ==
-----END PRIVATE KEY-----";
```
likely benign LLM, confidence 0.85 Inline PEM private key literal in a test.
Reasoning
This is a PEM-encoded private key in a test string, the form used for key-parsing tests. It is test fixture material with no decoding or execution path, though a committed key is worth noting as a hygiene issue rather than an attack.
info ~~warn~~ → info by review encoding-base64 src/ssl/connector.rs:18:1

base64-like blob (360 bytes over 6 lines, compression ratio 0.83) (raw pass, confidence 0.60)
```
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
```
likely benign LLM, confidence 0.90 PEM-encoded Diffie-Hellman parameters.
Reasoning
This is a standard RFC-style DH parameters PEM block with a well-known prime. Embedding DH parameters in a TLS connector test or fixture is normal, and the base64 is a legitimate encoding of public parameters.

info encoding-hex src/symm.rs:12:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

//! let data = b"Some Crypto Text";
//! let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
//! let iv = b"\x00\x01\x02\x03\x04\x05\x06\x07\x00\x01\x02\x03\x04\x05\x06\x07";
//! let ciphertext = encrypt(

info encoding-hex src/symm.rs:21:11

22 consecutive `\xNN` escapes (entropy 4.4 bits/byte) (in comment) (raw pass, confidence 0.39)

//! assert_eq!(
//!     b"\xB4\xB9\xE7\x30\xD6\xD6\xF7\xDE\x77\x3F\x1C\xFF\xB3\x3E\x44\x5A\x91\xD7\x27\x62\x87\x4D\
//!       \xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1",
//!     &ciphertext[..]);

info encoding-hex src/symm.rs:558:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

/// let plaintexts: [&[u8]; 2] = [b"Some Stream of", b" Crypto Text"];
/// let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
/// let iv = b"\x00\x01\x02\x03\x04\x05\x06\x07\x00\x01\x02\x03\x04\x05\x06\x07";
/// let data_len = plaintexts.iter().fold(0, |sum, x| sum + x.len());

info encoding-hex src/symm.rs:579:11

22 consecutive `\xNN` escapes (entropy 4.4 bits/byte) (in comment) (raw pass, confidence 0.39)

/// assert_eq!(
///     b"\x0F\x21\x83\x7E\xB2\x88\x04\xAF\xD9\xCC\xE2\x03\x49\xB4\x88\xF6\xC4\x61\x0E\x32\x1C\xF9\
///       \x0D\x66\xB1\xE6\x2C\x77\x76\x18\x8D\x99",
///     &ciphertext[..]

info encoding-hex src/symm.rs:779:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

/// let data = b"Some Crypto Text";
/// let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
/// let iv = b"\x00\x01\x02\x03\x04\x05\x06\x07\x00\x01\x02\x03\x04\x05\x06\x07";
/// let ciphertext = encrypt(

info encoding-hex src/symm.rs:788:11

22 consecutive `\xNN` escapes (entropy 4.4 bits/byte) (in comment) (raw pass, confidence 0.39)

/// assert_eq!(
///     b"\xB4\xB9\xE7\x30\xD6\xD6\xF7\xDE\x77\x3F\x1C\xFF\xB3\x3E\x44\x5A\x91\xD7\x27\x62\x87\x4D\
///       \xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1",
///     &ciphertext[..]);

info encoding-hex src/symm.rs:817:18

20 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (in comment) (raw pass, confidence 0.39)

/// let cipher = Cipher::aes_128_cbc();
/// let data = b"\xB4\xB9\xE7\x30\xD6\xD6\xF7\xDE\x77\x3F\x1C\xFF\xB3\x3E\x44\x5A\x91\xD7\x27\x62\
///              \x87\x4D\xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1";
/// let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";

info encoding-hex src/symm.rs:819:17

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

///              \x87\x4D\xFB\x3C\x5E\xC4\x59\x72\x4A\xF4\x7C\xA1";
/// let key = b"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F";
/// let iv = b"\x00\x01\x02\x03\x04\x05\x06\x07\x00\x01\x02\x03\x04\x05\x06\x07";
/// let ciphertext = decrypt(

info ~~critical~~ → info by review encoding-hex src/x509/tests.rs:197:12

20 consecutive `\xNN` escapes (entropy 4.2 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
        subject_key_id.as_slice(),
        &b"\xB6\x73\x2F\x61\xA5\x4B\xA1\xEF\x48\x2C\x15\xB1\x9F\xF3\xDC\x34\x2F\xBC\xAC\x30"[..]
    );
}
```
dismissed LLM, confidence 0.92 20-byte subject key identifier literal in an X509 test.
Reasoning
This is a 20-byte subject key identifier compared in an X509 test. Key-ID bytes in this form are normal test data, and the warning comes only from the escape-hex pattern.
info ~~critical~~ → info by review encoding-hex src/x509/tests.rs:210:12

20 consecutive `\xNN` escapes (entropy 4.2 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.65)
```
        authority_key_id.as_slice(),
        &b"\x6C\xD3\xA5\x03\xAB\x0D\x5F\x2C\xC9\x8D\x8A\x9C\x88\xA7\x88\x77\xB8\x37\xFD\x9A"[..]
    );
}
```
dismissed LLM, confidence 0.92 20-byte authority key identifier literal in an X509 test.
Reasoning
This is a 20-byte authority key identifier literal in an X509 test, the same pattern as the subject key ID. It is expected test data.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o openssl-0.10.82.crate 'https://static.crates.io/crates/openssl/openssl-0%2E10%2E82.crate'
printf '%s  %s\n' 4de8111e94a56adca7ebfe6c365b6d42f99deb69b74b6becacd4204e2f193aa2 openssl-0.10.82.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf openssl-0.10.82.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg