PT-2022-24876 · Unknown · Conduit-Hyper
Ori Hollander
·
Published
2022-10-30
·
Updated
2023-07-12
·
CVE-2022-39294
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
conduit-hyper versions prior to 0.4.2
Description
The issue arises from
conduit-hyper not checking any limit on a request's length before calling hyper::body::to bytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, conduit-hyper sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request"). This crate is part of the implementation of Rust's crates.io, but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, conduit-hyper is not recommended for production use, nor to directly serve the public Internet.Recommendations
For versions prior to 0.4.2, update to version 0.4.2 or later to set an internal limit of 128 MiB per request and return status 400 ("Bad Request") for requests exceeding this limit.
As a temporary workaround, consider restricting the
Content-Length of incoming requests to prevent potential memory allocation issues until a patch is available.
Avoid using conduit-hyper for production use or to directly serve the public Internet, even with the new limit in place.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Conduit-Hyper