CVE - CVE-2024-32650

CVE-ID
CVE-2024-32650	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d URL:https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d MISC:https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e URL:https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e MISC:https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e URL:https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e MISC:https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj URL:https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240416	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240416)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)