PT-2023-32968 · Unknown · Rustls-Webpki

Published 2023-08-24 · Updated 2023-08-24

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions rustls-webpki versions prior to 0.3.7

Description The issue arises during startup when an attacker can intercept traffic to and from NTS key exchange servers, triggering an expensive key validation process due to a vulnerability in webpki. This can lead to excessive CPU usage on startup for clients configured to use NTS.

Recommendations For versions prior to 0.3.7, upgrade to version 0.3.7 to resolve the issue. As a temporary workaround, consider restricting access to NTS key exchange servers to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1395

Related Identifiers

GHSA-37XQ-Q42P-RV3P

Affected Products

Rustls-Webpki

References · 5

• https://osv.dev/vulnerability/GHSA-37xq-q42p-rv3p · Vendor Advisory
• https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md · Note
• https://github.com/pendulum-project/ntpd-rs · Note
• https://github.com/pendulum-project/ntpd-rs/commit/927952a440176a18f3ded132eb831ae7f7ac5c00 · Note
• https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-37xq-q42p-rv3p · Note