Intel

AIKIDO-2024-10258

rustls is vulnerable to Improperly Implemented Security Check for Standard

Improperly Implemented Security Check for Standard Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Sep 12, 2024

20

Low Risk

This Affects:

rustrustls
0.20.6 - 0.23.12
Fixed in 0.23.13
Are you affected? Scan for Free

TL;DR

Affected versions of the package accept more early data than allowed by the TLS 1.3 standard, potentially leading to security vulnerabilities.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

rustls is vulnerable to Improperly Implemented Security Check for Standard in versions 0.20.6 - 0.23.12.

How to fix this

Upgrade the rustls library to the patch version.