DEBIAN-CVE-2024-32650

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/DEBIAN-CVE-2024-32650

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-32650.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2024-32650

Upstream

CVE-2024-32650

Published

2024-04-19T16:15:10Z

Modified

2025-09-19T06:14:46Z

Summary

[none]

Details

Rustls is a modern TLS library written in Rust. rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.

References

https://security-tracker.debian.org/tracker/CVE-2024-32650

Affected packages

Debian:13 / rust-rustls

Package

Name: rust-rustls
Purl: pkg:deb/debian/rust-rustls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.21.12-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / rust-rustls

Package

Name: rust-rustls
Purl: pkg:deb/debian/rust-rustls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.21.12-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}