Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update rusttls dependency #3714

Open
vervaekejonathan opened this issue Jun 24, 2024 · 0 comments
Open

Update rusttls dependency #3714

vervaekejonathan opened this issue Jun 24, 2024 · 0 comments

Comments

@vervaekejonathan
Copy link

This is the package maintainer's summary.

Rustls is a modern TLS library written in Rust. rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.The worst case impact for these vulnerabilities can be "Attacker can trigger DOS via infinite loop".

How do I fix it?

We recommend updating from 0.21.10 to 0.21.11.

@vervaekejonathan vervaekejonathan changed the title Update rusttls Update rusttls dependency Jun 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant