REDHAT-BUG-2328732: Medium severity Rustls rustls vulnerability

Published Nov 25, 2024

Updated

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.

Servers that use tokio-rustls's LazyConfigAcceptor API are affected.

Servers that use tokio-rustls's TlsAcceptor API are not affected.

Servers that use rustls-ffi's rustlsacceptoraccept API are affected.

Affected Software

3 affected components

Rustls rustls=0.23.13

tokio-rustls tokio-rustls=unknown

rustls-ffi rustls-ffi=unknown

Event History

Nov 25, 2024

Data Sourced

via Red Hat·06:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2328732?

The severity of REDHAT-BUG-2328732 is significant, as it can lead to server panic upon receiving fragmented TLS ClientHello messages.

How do I fix REDHAT-BUG-2328732?

To fix REDHAT-BUG-2328732, ensure that you do not use rustls version 0.23.13 and consider upgrading to a version where the bug is resolved.

Which software is affected by REDHAT-BUG-2328732?

REDHAT-BUG-2328732 affects rustls version 0.23.13 and servers using the tokio-rustls's LazyConfigAcceptor API.

How can I identify if my server is vulnerable to REDHAT-BUG-2328732?

You can identify if your server is vulnerable by checking if you are using rustls version 0.23.13 or the tokio-rustls's LazyConfigAcceptor API.

What is the impact of REDHAT-BUG-2328732 on my applications?

The impact of REDHAT-BUG-2328732 on your applications could include unexpected panics and downtime due to TLS ClientHello fragmentation.