Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input
Vulnerability Description
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
不可达退出条件的循环(无限循环)
Vulnerability Title
Rustls 安全漏洞
Vulnerability Description
Rustls是Rustls开源的一个 Rust 中的现代 TLS 库。 Rustls 0.23.5、0.22.4 和 0.21.11之前版本存在安全漏洞，该漏洞源于当使用 blocking rustls 服务器时，如果客户端在 client_hello 之后立即发送 close_notify 消息，服务器的 complete_io 将陷入无限循环。
CVSS Information
N/A
Vulnerability Type
N/A