CVE-2023-43669: High severity Snapview Tungstenite Rust vulnerability
The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
Other sources
The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/tungsteniteto a version that resolves this vulnerability.Fixed in 0.20.1 - Upgrade
Upgrade
debian/rust-tungsteniteto a version that resolves this vulnerability.Fixed in 0.24.0-3Fixed in 0.28.0-1
Event History
Frequently Asked Questions
What is CVE-2023-43669?
CVE-2023-43669 is a vulnerability in the Tungstenite crate for Rust that allows remote attackers to cause a denial of service by consuming excessive CPU resources.
How does CVE-2023-43669 affect the Tungstenite crate?
CVE-2023-43669 affects the Tungstenite crate through version 0.20.0 and allows remote attackers to cause a denial of service through an excessive length of an HTTP header in a client handshake.
What is the severity of CVE-2023-43669?
CVE-2023-43669 has a severity level of medium.
How can I fix CVE-2023-43669?
To fix CVE-2023-43669, update the Tungstenite crate to version 0.20.1 or later.
Where can I find more information about CVE-2023-43669?
You can find more information about CVE-2023-43669 in the NIST National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2023-43669.