rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2025-12-27 01:54:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

Create advisory for tungstenite DoS (#1795)

Browse Source 
* Create advisory for tungstenite DoS

* drop empty `keywords` key

---------

Co-authored-by: Sergey "Shnatsel" Davidoff <shnatsel@gmail.com>
This commit is contained in:
Dirkjan Ochtman
2023-09-29 14:00:45 +02:00
committed by GitHub
parent 9b6403d856
commit 2a2c8a0f01
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
crates/tungstenite/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "tungstenite"
date = "2023-09-25"
url = "https://github.com/snapview/tungstenite-rs/issues/376"
categories = ["denial-of-service"]
aliases = ["CVE-2023-43669", "GHSA-9mcr-873m-xcxp"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
[versions]
patched = [">= 0.20.1"]
```
# Tungstenite allows remote attackers to cause a denial of service
The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause
a denial of service (minutes of CPU consumption) via an excessive length of an
HTTP header in a client handshake. The length affects both how many times a parse
is attempted (e.g., thousands of times) and the average amount of data for each
parse attempt (e.g., millions of bytes).