Denial of Service Vulnerability in rust-rustls Package - CVE-2024-11738
Summary
UBUNTU-CVE-2024-11738: A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message. Affects rust-rustls versions 0.21.10-1 – 0.21.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-rustls package provides a Rust implementation of the TLS protocol, enabling secure communication over the internet. It is widely used in applications that require encrypted connections. The package is known for its performance and security features, but it has been identified to have a vulnerability that could lead to denial of service under specific conditions.
Vulnerability Detail
A flaw was discovered in Rustls versions 0.23.13 and related APIs, which allows for denial of service (panic) when a fragmented TLS ClientHello message is processed. This vulnerability can be exploited by an attacker to disrupt service, leading to potential downtime for applications relying on this library. The issue stems from improper handling of fragmented messages, which can cause the application to panic and crash.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to reject fragmented TLS ClientHello messages until the package can be updated. This can help mitigate the risk of denial of service attacks.
Conclusion
The rust-rustls package has a vulnerability (CVE-2024-11738) that can lead to denial of service through fragmented TLS ClientHello messages. It is crucial to update to the latest patched versions to mitigate this risk. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for rust-rustls →
FAQ
CVE-2024-11738 is a vulnerability in the rust-rustls package that allows denial of service through a fragmented TLS ClientHello message.
Versions 0.23.13 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
If immediate updates are not possible, implement input validation to reject fragmented TLS ClientHello messages as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for rust-rustls.
