RUSTSEC-2024-0336: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
- Dominant language
- Rust
- Stars
- 0
- Forks
- 0
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 3
Description
> `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls` |
| Version | `0.19.1` |
| URL | [https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj](https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj) |
| Date | 2024-04-19 |
| Patched versions | `>=0.23.5,>=0.22.4, <0.23.0,>=0.21.11, <0.22.0` |
If a `close_notify` alert is received during a handshake, `complete_io`
does not terminate.
Callers which do not call `complete_io` are not affected.
`rustls-tokio` and `rustls-ffi` do not call `complete_io`
and are not affected.
`rustls::Stream` and `rustls::StreamOwned` types use
`complete_io` and are affected.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2024-0336.html) for additional details.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.