Vulnerability Description
The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Snapview | Tungstenite | <= 0.20.0 |
| Fedoraproject | Fedora | 37 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2240110Issue TrackingThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1215563Issue TrackingThird Party Advisory
- https://crates.io/crates/tungstenite/versionsRelease Notes
- https://cwe.mitre.org/data/definitions/407.htmlTechnical Description
- https://github.com/advisories/GHSA-9mcr-873m-xcxpThird Party Advisory
- https://github.com/github/advisory-database/pull/2752Patch
- https://github.com/snapview/tungstenite-rs/commit/8b3ecd3cc0008145ab4bc8d0657c39Patch
- https://github.com/snapview/tungstenite-rs/issues/376ExploitIssue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-43669Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2240110Issue TrackingThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1215563Issue TrackingThird Party Advisory
- https://crates.io/crates/tungstenite/versionsRelease Notes
FAQ
What is CVE-2023-43669?
CVE-2023-43669 is a vulnerability with a CVSS score of 7.5 (HIGH). The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The leng...
How severe is CVE-2023-43669?
CVE-2023-43669 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-43669?
Check the references section above for vendor advisories and patch information. Affected products include: Snapview Tungstenite, Fedoraproject Fedora.