GHSA-qg5g-gv98-5ffh CVE-2024-11738 RUSTSEC-2024-0399
rustls network-reachable panic in `Acceptor::accept`
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.73%
- Chance of exploitation in the next 30 days. Higher than 54.31% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
0.23.18- Upgrade rustls to this version or later
Description
A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| rustls | >= 0.23.13, < 0.23.18 |
0.23.18 |
| rustls | >= 0.23.0, < 0.23.0>= 0.23.13, < 0.23.18 |
0.23.00.23.18 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rustls crates.io → 0.23.18
- cargo
cargo update -p rustls --precise 0.23.18
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vp88-798v-h67f rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert | Low | Also affects rustls |
| GHSA-w44r-93j7-qv28 rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share | Low | Also affects rustls |
| GHSA-h2v8-394m-p7vv Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. | Low | Also affects rustls |
| GHSA-c8m5-c952-6cm4 Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs | Medium | Also affects rustls |
| GHSA-2mjx-qc3c-rqvc Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | Medium | Also affects rustls |
| GHSA-6g7w-8wpp-frhj Denial of Service Vulnerability in Rustls Library | High | Also affects rustls |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | High | Same weakness, CWE-248 |
| GHSA-27r3-jxmh-p828 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | High | Same weakness, CWE-248 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor