Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1xZzVnLWd2OTgtNWZmaM4ABBvH
rustls network-reachable panic in `Acceptor::accept`
A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZzVnLWd2OTgtNWZmaM4ABBvH
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 16 days ago
Updated: 16 days ago
Identifiers: GHSA-qg5g-gv98-5ffh
References:
- https://github.com/rustls/rustls/issues/2227
- https://rustsec.org/advisories/RUSTSEC-2024-0399.html
- https://github.com/advisories/GHSA-qg5g-gv98-5ffh
Blast Radius: 0.0
Affected Packages
cargo:rustls
Dependent packages: 887Dependent repositories: 18,497
Downloads: 197,639,880 total
Affected Version Ranges: >= 0.23.13, < 0.23.18
Fixed in: 0.23.18
All affected versions: 0.23.13, 0.23.14, 0.23.15, 0.23.16, 0.23.17
All unaffected versions: 0.1.0, 0.1.1, 0.1.2, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.6.0, 0.7.0, 0.8.0, 0.9.0, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.13.1, 0.14.0, 0.15.0, 0.15.1, 0.15.2, 0.16.0, 0.17.0, 0.18.0, 0.18.1, 0.19.0, 0.19.1, 0.20.0, 0.20.1, 0.20.2, 0.20.3, 0.20.4, 0.20.5, 0.20.6, 0.20.7, 0.20.8, 0.20.9, 0.21.0, 0.21.1, 0.21.2, 0.21.3, 0.21.4, 0.21.5, 0.21.6, 0.21.7, 0.21.8, 0.21.9, 0.21.10, 0.21.11, 0.21.12, 0.22.0, 0.22.1, 0.22.2, 0.22.3, 0.22.4, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.23.8, 0.23.9, 0.23.10, 0.23.11, 0.23.12, 0.23.18, 0.23.19