Description
tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tmccombs | tls-listener | < 0.10.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cargo-audit-advisory-db | 20240528-1.1 | openSUSE-SU-2024:14009-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | sdp-k8s-injector | 1.4.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | tls-listener | < 0.10.0 | 0.10.0 | GHSA-2qph-qpvm-2qf7 |
| crates.io | tls-listener | >= 0.0.0-0, < 0.10.0 | 0.10.0 | RUSTSEC-2024-0341 |
Advisories 1
- openSUSE-SU-2024:14009-1 cargo-audit-advisory-db-20240528-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026