Fedora 41 update for rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-47609 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Fedora Operating systems & Components / Operating system rust-tower0.4 Operating systems & Components / Operating system package or component rust-tower-http0.5 Operating systems & Components / Operating system package or component rust-tower-http Operating systems & Components / Operating system package or component rust-tower Operating systems & Components / Operating system package or component rust-tonic-types Operating systems & Components / Operating system package or component rust-tonic-build Operating systems & Components / Operating system package or component rust-tonic Operating systems & Components / Operating system package or component rust-rustls-native-certs0.7 Operating systems & Components / Operating system package or component rust-rustls-native-certs Operating systems & Components / Operating system package or component rust-reqwest Operating systems & Components / Operating system package or component rust-hyper-rustls Operating systems & Components / Operating system package or component |
| Vendor | Fedoraproject |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Input validation error
EUVDB-ID: #VU98514
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-47609
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack on accepting a TCP/TLS stream.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsFedora: 41
rust-tower0.4: before 0.4.13-1.fc41
rust-tower-http0.5: before 0.5.2-1.fc41
rust-tower-http: before 0.6.1-1.fc41
rust-tower: before 0.5.1-1.fc41
rust-tonic-types: before 0.12.3-1.fc41
rust-tonic-build: before 0.12.3-1.fc41
rust-tonic: before 0.12.3-1.fc41
rust-rustls-native-certs0.7: before 0.7.3-1.fc41
rust-rustls-native-certs: before 0.8.0-1.fc41
rust-reqwest: before 0.12.8-1.fc41
rust-hyper-rustls: before 0.27.3-1.fc41
CPE2.3- cpe:2.3:o:fedoraproject:fedora:41:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:rust-tower0.4:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-tower-http0.5:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-tower-http:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-tower:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-tonic-types:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-tonic-build:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-tonic:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-rustls-native-certs0.7:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-rustls-native-certs:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-reqwest:*:*:*:*:*:fedora:*:
- cpe:2.3:o:fedoraproject:rust-hyper-rustls:*:*:*:*:*:fedora:*:
http://bodhi.fedoraproject.org/updates/FEDORA-2024-347164df1c
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
