RUSTSEC-2024-0341: 
Rust vulnerability analysis and mitigation

A high-severity vulnerability (RUSTSEC-2024-0341) was discovered in the tls-listener Rust package, affecting version 0.9.1. The vulnerability was disclosed on March 15, 2024, and involves a slow loris Denial of Service (DoS) attack possibility when using the default configuration. The issue affects any publicly accessible service using the default configuration of tls-listener (GitHub Advisory).

The vulnerability stems from the default configuration parameters in tls-listener, specifically the DEFAULT_MAX_HANDSHAKES set to 64 and DEFAULT_HANDSHAKE_TIMEOUT set to 10 seconds. With these settings, a malicious user can open approximately 6.4 TcpStreams per second while sending zero bytes, leading to a potential DoS condition. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low complexity, no privileges required, and high impact on availability (GitHub Advisory).

The vulnerability enables successful slow-loris attacks against any publicly accessible service using the default configuration of tls-listener. When exploited, the attack can prevent new connections to the server, effectively causing a denial of service condition (GitHub Advisory).

A proof of concept exploit has been demonstrated using the HTTP TLS server example. The exploit involves creating multiple connections at a controlled rate, effectively exhausting the server's connection handling capacity (GitHub Advisory).

For previous versions, the vulnerability can be mitigated by passing a large value, such as usize::MAX, as the parameter to Builder::max_handshakes. The issue has been patched in version 0.10.0 (GitHub Advisory).