Input validation error in tonic - CVE-2024-47609

Vulnerability identifier: #VU98514

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-47609

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack on accepting a TCP/TLS stream.

tonic
Fedora
rust-tower0.4
rust-tower
rust-tower-http0.5
rust-tower-http
rust-rustls-native-certs0.7
rust-rustls-native-certs
rust-tonic-types
rust-tonic-build
rust-tonic
rust-reqwest
rust-hyper-rustls

Install updates from vendor's website.

tonic - update to 0.12.3
rust-tower0.4 - addressed in versions 0.4.13-1.fc39, 0.4.13-1.fc40, 0.4.13-1.fc41, 0.4.13-1.fc42
rust-tower - addressed in versions 0.5.1-1.fc39, 0.5.1-1.fc40, 0.5.1-1.fc41, 0.5.1-1.fc42
rust-tower-http0.5 - addressed in versions 0.5.2-1.fc39, 0.5.2-1.fc40, 0.5.2-1.fc41, 0.5.2-1.fc42
rust-tower-http - addressed in versions 0.6.1-1.fc39, 0.6.1-1.fc40, 0.6.1-1.fc41, 0.6.1-1.fc42
rust-rustls-native-certs0.7 - addressed in versions 0.7.3-1.fc39, 0.7.3-1.fc40, 0.7.3-1.fc41, 0.7.3-1.fc42
rust-rustls-native-certs - addressed in versions 0.8.0-1.fc39, 0.8.0-1.fc40, 0.8.0-1.fc41, 0.8.0-1.fc42
rust-tonic-types - addressed in versions 0.12.3-1.fc39, 0.12.3-1.fc40, 0.12.3-1.fc41, 0.12.3-1.fc42
rust-tonic-build - addressed in versions 0.12.3-1.fc39, 0.12.3-1.fc40, 0.12.3-1.fc41, 0.12.3-1.fc42
rust-tonic - addressed in versions 0.12.3-1.fc39, 0.12.3-1.fc40, 0.12.3-1.fc41, 0.12.3-1.fc42
rust-reqwest - addressed in versions 0.12.8-1.fc39, 0.12.8-1.fc40, 0.12.8-1.fc41, 0.12.8-1.fc42
rust-hyper-rustls - addressed in versions 0.27.3-1.fc39, 0.27.3-1.fc40, 0.27.3-1.fc41, 0.27.3-1.fc42

• https://github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv
• https://github.com/hyperium/tonic/issues/1897
• https://github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48
• https://github.com/grpc/grpc-rust/security/advisories/GHSA-4jwc-w2hc-78qv

• Remote denial of service in Hyperium Tonic
• Fedora 42 update for rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4
• Fedora 41 update for rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4
• Fedora 40 update for rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4
• Fedora 39 update for rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4