From dece728123064a39302dcd63f656c49c29c98092 Mon Sep 17 00:00:00 2001 From: Niklas Fiekas Date: Sun, 16 Feb 2025 21:23:25 +0100 Subject: [PATCH] Report denial-of-service in web-push via malicious Web Push endpoint --- crates/web-push/RUSTSEC-0000-0000.md | 30 ++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 crates/web-push/RUSTSEC-0000-0000.md diff --git a/crates/web-push/RUSTSEC-0000-0000.md b/crates/web-push/RUSTSEC-0000-0000.md new file mode 100644 index 00000000..24bb6eac --- /dev/null +++ b/crates/web-push/RUSTSEC-0000-0000.md @@ -0,0 +1,30 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "web-push" +date = "2025-02-16" +url = "https://github.com/pimeys/rust-web-push/pull/68" +categories = ["denial-of-service"] +keywords = ["panic", "oom"] + +[versions] +patched = [">= 0.10.3"] +``` + +# Denial of Service via malicious Web Push endpoint + +Prior to version 0.10.3, the built-in clients of the `web-push` crate +eagerly allocated memory based on the `Content-Length` header returned by the +Web Push endpoint. Malicious Web Push endpoints could return a large +`Content-Length` without ever having to send as much data, leading to +denial of service by memory exhaustion. + +Services providing Web Push notifications typically allow the user to +register an arbitrary endpoint, so the endpoint should not be trusted. + +The fixed version 0.10.3 now limits the amount of memory it will allocate +for each response, limits the amount of data it will read from the endpoint, +and returns an error if the endpoint sends too much data. + +As before, it is recommended that services add a timeout for each request +to Web Push endpoints.