Race Condition Affecting s2n-tls package, versions <1.5.9
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-S2NTLS-8382101
- published 15 Nov 2024
- disclosed 14 Nov 2024
- credit Unknown
How to fix?
Upgrade s2n-tls to version 1.5.9 or higher.
Overview
s2n-tls is a crate provides ergonomic, idiomatic Rust bindings for s2n-tls. From the s2n-tls readme:
Affected versions of this package are vulnerable to Race Condition due to the use of the Linux atexit function in a multi-threaded environment. An attacker can cause the application to crash or exhibit undefined behavior by triggering the cleanup process while other threads are still active.