Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RUSTSEC-2020-0043: Insufficient size checks in outgoing buffer in ws allows remote attacker to run the process out of memory #1595

Closed
github-actions bot opened this issue Sep 26, 2020 · 1 comment · Fixed by #1609

Comments

@github-actions
Copy link

Insufficient size checks in outgoing buffer in ws allows remote attacker to run the process out of memory

Details
Package ws
Version 0.9.1
URL housleyjk/ws-rs#291
Date 2020-09-25

Affected versions of this crate did not properly check and cap the growth of the outgoing buffer.

This allows a remote attacker to take down the process by growing the buffer of their (single) connection until the process runs out of memory it can allocate and is killed.

The flaw was corrected in the parity-ws fork (>0.10.0) by disconnecting a client when the buffer runs full.

See advisory page for additional details.

@tmpolaczyk
Copy link
Contributor

Using cargo tree:

ws v0.9.1 is a dependency of jsonrpc-ws-server v14.0.6, which is a dependency of witnet_net

Updating jsonrpc-ws-server to the latest version should probably fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant