Bug 1188174 (CVE-2021-32714) - VUL-0: CVE-2021-32714: rust: hyper - Integer Overflow in Chunked Transfer-Encoding
Summary: VUL-0: CVE-2021-32714: rust: hyper - Integer Overflow in Chunked Transfer-Enc...
Status: RESOLVED FIXED
Alias: CVE-2021-32714
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: William Brown
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/303635/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-32714:5.9:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2021-07-09 13:50 UTC by Robert Frohl
Modified: 2023-07-04 07:20 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2021-07-09 13:50:50 UTC
CVE-2021-32714

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP
server and client code had a flaw that could trigger an integer overflow when
decoding chunk sizes that are too big. This allows possible data loss, or if
combined with an upstream HTTP proxy that allows chunk sizes larger than hyper
does, can result in "request smuggling" or "desync attacks." The vulnerability
is patched in version 0.14.10. Two possible workarounds exist. One may reject
requests manually that contain a `Transfer-Encoding` header or ensure any
upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in
64-bit unsigned integers.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32714
https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9
Comment 1 Robert Frohl 2021-07-09 13:52:15 UTC
rust embeds hyper version 0.12.31, therefor tracking as affected:

- SUSE:SLE-15:Update/rust
- SUSE:SLE-15-SP1:Update/rust
Comment 3 Robert Frohl 2022-01-21 12:29:24 UTC
hyper was removed with version 1.46.0 (by
6654c5852f76d6b55ebdacc0d428cad5b3dbdbed)

Which means SLE15-SP3 is not affected, because rust1.43 is out of support.
SLE15 and SLE15-SP1 are now on 1.53.
Comment 4 Robert Frohl 2022-01-21 12:30:00 UTC
closing