Race Condition Affecting s2n-tls package, versions <1.5.9
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-S2NTLS-8382101
- published15 Nov 2024
- disclosed14 Nov 2024
- creditUnknown
Introduced: 14 Nov 2024
CVE NOT AVAILABLE CWE-362 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade s2n-tls to version 1.5.9 or higher.
Overview
s2n-tls is a crate provides ergonomic, idiomatic Rust bindings for s2n-tls. From the s2n-tls readme:
Affected versions of this package are vulnerable to Race Condition due to the use of the Linux atexit function in a multi-threaded environment. An attacker can cause the application to crash or exhibit undefined behavior by triggering the cleanup process while other threads are still active.