CVE-2023-22466

Katalog CVE

CVSS 5.4 · Medium EPSS 0,56%

Kerentanan Improper Initialization pada tokio. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.

Rincian

Terbit di NVD

4 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-665: Improper Initialization

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tokio-rs/tokio/pull/5336 patch · advisory pihak ketiga
• https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7 mitigasi · advisory pihak ketiga
• https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1 release notes · advisory pihak ketiga
• https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_cli... deskripsi teknis · advisory pihak ketiga