CVE-2020-35896: ws - Insufficient size checks leading to remote memory-consumption attack
Summary
CVE-2020-35896: Insufficient size checks in ws. Affects ws versions < 0.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ws crate is a WebSocket library for Rust, available on crates.io. It provides functionality for creating WebSocket servers and clients. WebSocket is a communication protocol that enables bidirectional communication between a client and a server over a single, long-lived connection. The ws crate is widely used in Rust applications for implementing WebSocket functionality.
Vulnerability Detail
The ws crate through 2020-09-25 for Rust is affected by an insufficient size checks vulnerability. This vulnerability allows for a remote memory-consumption attack. The issue arises from the outgoing buffer not being properly limited. An attacker can exploit this vulnerability to consume excessive memory resources on the target system, potentially leading to denial of service (DoS) conditions or other adverse effects.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the ws crate to the patched version to mitigate the risk.
Conclusion
The ws crate through 2020-09-25 for Rust is vulnerable to a remote memory-consumption attack due to insufficient size checks in the outgoing buffer. To mitigate this vulnerability, it is crucial to update the ws crate to version 0.9.1 or later. There is no known workaround for this issue. For additional support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ws →
FAQ
The ws crate is a WebSocket library for Rust, used for implementing WebSocket functionality in Rust applications.
A remote memory-consumption attack is an attack where an attacker exploits a vulnerability to consume excessive memory resources on a target system, potentially leading to denial of service (DoS) conditions or other adverse effects.
This vulnerability can lead to denial of service (DoS) conditions on systems using the vulnerable version of the ws crate. It can also impact the stability and performance of the affected application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Cargo.lock file and provides real-time alerts for open-source vulnerabilities in your software.
For further support on vulnerability remediation, you can contact info@devnack.com. Our team will be happy to assist you in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ws.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
