tokio-tungstenite-0.21.0.crate: 2 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - tokio-tungstenite-0.21.0.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Found in HEAD commit: 327133720fbb3c4d76df4b0f08c235199399c3eb

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (tokio-tungstenite version)	Remediation Possible**
CVE-2023-43669	High	7.5	tungstenite-0.21.0.crate	Transitive	N/A*	❌
CVE-2024-2511	Low	3.7	openssl-src-300.2.3+3.2.1.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-43669

Vulnerable Library - tungstenite-0.21.0.crate

Lightweight stream-based WebSocket implementation

Library home page: https://static.crates.io/crates/tungstenite/tungstenite-0.21.0.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• tokio-tungstenite-0.21.0.crate (Root Library)
  • ❌ tungstenite-0.21.0.crate (Vulnerable Library)

Found in HEAD commit: 327133720fbb3c4d76df4b0f08c235199399c3eb

Found in base branch: v6

Vulnerability Details

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).

Publish Date: 2023-09-21

URL: CVE-2023-43669

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2024-2511

Vulnerable Library - openssl-src-300.2.3+3.2.1.crate

Source of OpenSSL and logic to build it.

Library home page: https://static.crates.io/crates/openssl-src/openssl-src-300.2.3+3.2.1.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• tokio-tungstenite-0.21.0.crate (Root Library)
  • native-tls-0.2.11.crate
    • openssl-0.10.64.crate
      • openssl-sys-0.9.102.crate
        • ❌ openssl-src-300.2.3+3.2.1.crate (Vulnerable Library)

Found in HEAD commit: 327133720fbb3c4d76df4b0f08c235199399c3eb

Found in base branch: v6

Vulnerability Details

Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions

Impact summary: An attacker may exploit certain server configurations to trigger
unbounded memory growth that would lead to a Denial of Service

This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
being used (but not if early_data support is also configured and the default
anti-replay protection is in use). In this case, under certain conditions, the
session cache can get into an incorrect state and it will fail to flush properly
as it fills. The session cache will continue to grow in an unbounded manner. A
malicious client could deliberately create the scenario for this failure to
force a Denial of Service. It may also happen by accident in normal operation.

This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
clients.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
1.0.2 is also not affected by this issue.

Publish Date: 2024-04-08

URL: CVE-2024-2511

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://seclists.org/oss-sec/2024/q2/44

Release Date: 2024-04-08

Fix Resolution: openssl-3.0.14,openssl-3.1.6,openssl-3.2.2,OpenSSL_1_1_1y

Step up your Open Source Security Game with Mend here