CVE-2023-43669

Katalog CVE

CVSS 7.5 · High EPSS 2,1%

Kerentanan pada snapview tungstenite, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).

Rincian

Terbit di NVD

21 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/github/advisory-database/pull/2752 patch
• https://github.com/snapview/tungstenite-rs/commit/8b3ecd3cc0008145ab4bc8d0657c39d09db8c7e2 patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2240110 issue tracking · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1215563 issue tracking · advisory pihak ketiga
• https://github.com/advisories/GHSA-9mcr-873m-xcxp advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R77EUWPZVP5WS... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THK6G6CD4VW6R... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TT7SF6CQ5VHAG... mailing list · advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2023-43669 advisory pihak ketiga
• https://github.com/snapview/tungstenite-rs/issues/376 exploit · issue tracking
• https://crates.io/crates/tungstenite/versions release notes
• https://cwe.mitre.org/data/definitions/407.html deskripsi teknis