CVE-2024-32650RUSTSEC-2024-0336GHSA-6G7W-8WPP-FRHJ
Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.23.5, 0.22.4, 0.21.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- rustls rustls
From 0.23.0 · fixed in 0.23.5; From 0.22.0 · fixed in 0.22.4; From 0.21.0 · fixed in 0.21.11
- rustlscrates.io
From 0.0.0-0 · fixed in 0.21.11; From 0.22.0 · fixed in 0.22.4; From 0.23.0 · fixed in 0.23.5
- rustlscrates.io
From 0.23.0 · fixed in 0.23.5
- rustlscrates.io
From 0.22.0 · fixed in 0.22.4
- rustlscrates.io
From 0.21.0 · fixed in 0.21.11
- rustlscrates.io
0.20