PT-2020-17528 · Rust · Ws

Published 2020-09-25 · Updated 2022-12-03 · CVE-2020-35896

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ws crate versions prior to 2020-09-25

Description An issue in the ws crate allows a remote memory-consumption attack due to the outgoing buffer not being properly limited. This enables a remote attacker to take down the process by growing the buffer of their connection until the process runs out of memory. The flaw was corrected by disconnecting a client when the buffer runs full.

Recommendations For ws crate versions prior to 2020-09-25, consider updating to the parity-ws fork version 0.10.0 or later, which includes the fix for this issue by disconnecting a client when the buffer runs full.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2020-35896

GHSA-RH7X-PPXX-P34C

RUSTSEC-2020-0043

Affected Products

Ws

References · 9

• https://osv.dev/vulnerability/GHSA-rh7x-ppxx-p34c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35896 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2020-0043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35896 · Security Note
• https://github.com/housleyjk/ws-rs/issues/291 · Note
• https://github.com/housleyjk/ws-rs · Note
• https://t.me/cibsecurity/21468 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2020-0043.html · Note
• https://crates.io/crates/ws · Note