Description

Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

INFO

Published Date :

2024-04-19T16:05:44.050Z

Last Modified :

2024-08-02T02:13:40.195Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-32650 vulnerability.

Vendors Products
Rustls Project
  • Rustls
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-32650.

URL Resource
https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d cve-icon cve-icon
https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e cve-icon cve-icon
https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e cve-icon cve-icon
https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact