add entry for pkg:cargo/rustls-webpki

CMK-34962

Change-Id: I7f35c11e3643845335403c106154d9e9bf46e7a3

Author: salvatorenitopi

omd/dependency_management/vulnerability_info.yml

@@ -1,3 +1,16 @@
+pkg:cargo/rustls-webpki@0.103.4:
+  RUSTSEC-2026-0104:
+    reason: The issue only affects applications that enable CRL revocation checking. We pull in rustls-webpki transitively via rustls in the check-http active check and in cmk-agent-ctl, neither of which configures CRLs. The update is tracked in CMK-34961.
+    state: not_affected
+  RUSTSEC-2026-0098:
+    reason: The issue only affects certificate chains that carry URI name constraints. cmk-agent-ctl only trusts the site CA, which we issue ourselves and which sets no name constraints. The check-http active check trusts the public CCADB root store, so exploiting it would require a misissuance by a public CA. We also never assert URI names, only DNS names and IP addresses. The update is tracked in CMK-34961.
+    state: not_affected
+  RUSTSEC-2026-0049:
+    reason: The issue only affects applications that enable CRL revocation checking. We pull in rustls-webpki transitively via rustls in the check-http active check and in cmk-agent-ctl, neither of which configures CRLs. The update is tracked in CMK-34961.
+    state: not_affected
+  RUSTSEC-2026-0099:
+    reason: The issue only affects certificate chains that carry DNS name constraints. cmk-agent-ctl only trusts the site CA, which we issue ourselves and which sets no name constraints. The check-http active check trusts the public CCADB root store, so exploiting it would require a misissuance by a public CA and would at most allow impersonating a monitored HTTPS endpoint. The update is tracked in CMK-34961.
+    state: not_affected
 pkg:generic/nagios@3.5.1:
   CVE-2008-4796:
     reason: The issue affects the front-end of Nagios. We only include the Nagios monitoring core and not the front-end (see omd/packages/nagios/nagios.make).