CVE-2024-47609

EUVD-2024-2937
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Debian logo
Debian Releases
Debian Product
Codename
rust-tonic
forky
0.12.3+dfsg-5
fixed
sid
0.12.3+dfsg-6
fixed
trixie
0.12.3+dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rust-tonic
focal
dne
jammy
dne
noble
dne
oracular
ignored
plucky
needs-triage
questing
needs-triage