CVE-2024-58254: Medium severity Rustls rustls vulnerability
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-11738. Reason: This candidate is a duplicate of CVE-2024-11738. Notes: All CVE users should reference CVE-2024-11738 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58254?
CVE-2024-58254 has a moderate severity level due to the potential for denial of service via panic when handling fragmented TLS ClientHello messages.
How do I fix CVE-2024-58254?
To mitigate CVE-2024-58254, upgrade the rustls crate to version 0.23.18 or later.
What versions are affected by CVE-2024-58254?
CVE-2024-58254 affects rustls versions from 0.23.13 up to but not including 0.23.18.
What are the potential impacts of CVE-2024-58254?
The potential impact of CVE-2024-58254 includes application panic and denial of service during TLS handshake processing.
What does the CVE-2024-58254 vulnerability involve?
CVE-2024-58254 involves a panic in rustls when the Acceptor::accept function processes a fragmented TLS ClientHello.