CVE-2023-43669: Tungstenite allows remote attackers to cause a denial of service
(updated )
The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
References
- bugzilla.redhat.com/show_bug.cgi?id=2240110
- bugzilla.suse.com/show_bug.cgi?id=1215563
- crates.io/crates/tungstenite/versions
- cwe.mitre.org/data/definitions/407.html
- github.com/advisories/GHSA-9mcr-873m-xcxp
- github.com/github/advisory-database/pull/2752
- github.com/snapview/tungstenite-rs
- github.com/snapview/tungstenite-rs/commit/8b3ecd3cc0008145ab4bc8d0657c39d09db8c7e2
- github.com/snapview/tungstenite-rs/issues/376
- github.com/snapview/tungstenite-rs/pull/379
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R77EUWPZVP5WSMNXUXUDNHR7G7OI5NGM
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THK6G6CD4VW6RCROWUV2C4HSINKK3XAK
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TT7SF6CQ5VHAGFLWNXY64NFSW4WIWE7D
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R77EUWPZVP5WSMNXUXUDNHR7G7OI5NGM
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THK6G6CD4VW6RCROWUV2C4HSINKK3XAK
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TT7SF6CQ5VHAGFLWNXY64NFSW4WIWE7D
- nvd.nist.gov/vuln/detail/CVE-2023-43669
- rustsec.org/advisories/RUSTSEC-2023-0065.html
- security-tracker.debian.org/tracker/CVE-2023-43669
Code Behaviors & Features
Detect and mitigate CVE-2023-43669 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →