Skip to content
OpenAdvisories
High · 7.5 CVE-2024-28854 EUVD-2024-0790GHSA-2qph-qpvm-2qf7RUSTSEC-2024-0341

Slow loris vulnerability with default configuration in tls-listener

Published Mar 15, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.

Affected products

VendorProductAffectedFixed
tmccombs tls-listener < 0.10.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed cargo-audit-advisory-db 20240528-1.1 openSUSE-SU-2024:14009-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling sdp-k8s-injector 1.4.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io tls-listener < 0.10.0 0.10.0 GHSA-2qph-qpvm-2qf7
crates.io tls-listener >= 0.0.0-0, < 0.10.0 0.10.0 RUSTSEC-2024-0341

Advisories 1

References