FuelLabs / FuelLabs/forc

RUSTSEC-2024-0336: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

Open
#15 0 comments 0 reactions 0 assignees View on GitHub
forc-wallet
Dominant language
Rust
Stars
0
Forks
0
Avg merge
1d 22h
Merged PRs (30d)
3

Description

> `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `rustls` |
| Version | `0.19.1` |
| URL | [https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj](https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj) |
| Date | 2024-04-19 |
| Patched versions | `>=0.23.5,>=0.22.4, <0.23.0,>=0.21.11, <0.22.0` |

If a `close_notify` alert is received during a handshake, `complete_io`
does not terminate.

Callers which do not call `complete_io` are not affected.

`rustls-tokio` and `rustls-ffi` do not call `complete_io`
and are not affected.

`rustls::Stream` and `rustls::StreamOwned` types use
`complete_io` and are affected.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2024-0336.html) for additional details.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.