tokio-1.21.2.crate: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

[mend-for-github-com]

Vulnerable Library - tokio-1.21.2.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.2/download

Found in HEAD commit: 10bf259ce4fd670cea2c26f88e83368d4fd375ed

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (tokio version)	Remediation Available
WS-2023-0027	High	9.8	tokio-1.21.2.crate	Direct	tokio - 1.18.5,1.20.4,1.24.2	❌
CVE-2023-22466	Medium	5.4	tokio-1.21.2.crate	Direct	tokio - 1.18.4,1.20.3,1.23.1	❌

Details

WS-2023-0027

Vulnerable Library - tokio-1.21.2.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.2/download

Dependency Hierarchy:

• ❌ tokio-1.21.2.crate (Vulnerable Library)

Found in HEAD commit: 10bf259ce4fd670cea2c26f88e83368d4fd375ed

Found in base branch: main

Vulnerability Details

A soundness issue was discovered in tokio. tokio::io::ReadHalf::unsplit can violate the Pin contract. Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code. The tokio feature io-util is also required to be enabled to trigger this soundness issue.

Publish Date: 2023-02-02

URL: WS-2023-0027

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2023-0005.html

Release Date: 2023-02-02

Fix Resolution: tokio - 1.18.5,1.20.4,1.24.2

CVE-2023-22466

Vulnerable Library - tokio-1.21.2.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.2/download

Dependency Hierarchy:

• ❌ tokio-1.21.2.crate (Vulnerable Library)

Found in HEAD commit: 10bf259ce4fd670cea2c26f88e83368d4fd375ed

Found in base branch: main

Vulnerability Details

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously configured reject_remote_clients to true, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that pipe_mode is set first after initializing a ServerOptions.

Publish Date: 2023-01-04

URL: CVE-2023-22466

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7rrj-xr53-82p7

Release Date: 2023-01-04

Fix Resolution: tokio - 1.18.4,1.20.3,1.23.1

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.