VDB
CVE-2024-47609
CVE-2024-47609
PUBLISHED
CVSS 6.900000095367432 MEDIUM
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
EPSS 0.62% · 47.1th percentile
Risk Scores
CVSS 4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
EPSS Score
0.62%
47.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hyperium | tonic | >= 0.12.2, < 0.12.3, >= 0.12.2, < 0.12.3 |
| hyperium | tonic | 0, 0, 0 |
| crates.io | tonic | 0.12.2, 0.12.2, 0.12.2 |
Timeline
- Jan 21, 1970 Security Advisory
- Oct 1, 2024 CVE Published
- Oct 1, 2024 PoC Published
- Oct 2, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 21, 2024 EPSS Score
- Nov 9, 2024 EPSS Score
- Nov 21, 2024 CVE Updated
- Nov 29, 2024 EPSS Score
- Dec 19, 2024 EPSS Score
- Jan 7, 2025 EPSS Score
- Jan 26, 2025 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-47609 advisory
- https://github.com/hyperium/tonic package
- https://rustsec.org/advisories/RUSTSEC-2024-0376.html url
- https://github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48 technical
- https://github.com/hyperium/tonic/issues/1897 technical
- https://github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv technical