PT-2020-17507 · Tokio · Tokio-Rustls

Published 2020-05-19 · Updated 2021-08-25 · CVE-2020-35875

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tokio-rustls versions prior to 0.13.1

Description The issue is related to excessive memory usage that may occur when data arrives quickly. This happens because tokio-rustls does not call process new packets immediately after read, causing the expected termination condition wants read to always return true. As a result, data will be buffered as long as new incoming data arrives faster than it is processed and the reader does not return pending. This may cause a Denial of Service (DoS).

Recommendations For versions prior to 0.13.1, update to version 0.13.1 or later to resolve the issue. As a temporary workaround, consider implementing measures to limit the rate of incoming data to prevent excessive buffering.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-35875

GHSA-2JFV-G3FH-XQ3V

RUSTSEC-2020-0019

Affected Products

Tokio-Rustls

References · 10

• https://rustsec.org/advisories/RUSTSEC-2020-0019.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-35875 · Security Note
• https://osv.dev/vulnerability/GHSA-2jfv-g3fh-xq3v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35875 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0019 · Vendor Advisory
• https://github.com/tokio-rs/tls · Note
• https://github.com/tokio-rs/tls/pull/14 · Note
• https://t.me/cvenotify/8015 · Telegram Post
• https://crates.io/crates/tokio-rustls · Note
• https://t.me/cvenotify/8271 · Telegram Post