VDB
CVE-2024-47609
CVE-2024-47609
PUBLISHED
CVSS 6.900000095367432 MEDIUM
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
EPSS 0.62% · 49.5th percentile
Risk Scores
CVSS 4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
EPSS Score
0.62%
49.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hyperium | tonic | >= 0.12.2, < 0.12.3, >= 0.12.2, < 0.12.3 |
| hyperium | tonic | 0, 0, 0 |
| crates.io | tonic | 0.12.2, 0.12.2, 0.12.2 |
Timeline
- Jan 21, 1970 Security Advisory
- Oct 1, 2024 CVE Published
- Oct 1, 2024 PoC Published
- Oct 2, 2024 EPSS Score
- Oct 5, 2024 Coalition ESS Score
- Oct 22, 2024 EPSS Score
- Nov 11, 2024 EPSS Score
- Dec 2, 2024 EPSS Score
- Dec 22, 2024 EPSS Score
- Jan 11, 2025 EPSS Score
- Jan 31, 2025 EPSS Score
- Feb 20, 2025 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-47609 advisory
- https://github.com/hyperium/tonic package
- https://rustsec.org/advisories/RUSTSEC-2024-0376.html url
- https://github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv technical
- https://github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48 fix
- https://github.com/hyperium/tonic/issues/1897 discussion