loona-hpack

Version	Released
`0.4.3` unknown	Nov 03, 2024
`0.4.2` unknown 1 CVE	Sep 17, 2024
`0.4.1` unknown 1 CVE	Sep 05, 2024
`0.4.0` unknown 1 CVE	Aug 21, 2024
`0.3.2` unknown 1 CVE	Aug 14, 2024
`0.3.1` unknown 1 CVE	Aug 14, 2024

0.4.3 unknown

Nov 03, 2024

0.4.2 unknown

1 CVE

CVE-2024-51502 GHSA-7vm6-qwh5-9x44 Nov 04, 2024

loona-hpack Panic Vulnerability

Medium

Network Low Low

Summary

loona-hpack suffers from the same vulnerability as the original hpack as documented in https://github.com/mlalic/hpack-rs/issues/11

Details

The original includes a very nice description of the problem, as well as an easy-enough fix for it.

PoC

The original example pretty much still applies:

use loona_hpack::Decoder;

pub fn main() {
    let input = &[0x3f];
    let mut decoder = Decoder::new();
    let _ = decoder.decode(input);
}

Impact

From the original: All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on [crates.io](https://crates.io/crates/hpack-patched) under the name hpack-patched. See [Cargo's documentation on overriding dependencies](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html) for more information.

Fixed in


          0.4.3

References

Updated Nov 05, 2024 · Source: OSV.dev

Sep 17, 2024

0.4.1 unknown

1 CVE

CVE-2024-51502 GHSA-7vm6-qwh5-9x44 Nov 04, 2024

loona-hpack Panic Vulnerability

Medium

Network Low Low

Summary

loona-hpack suffers from the same vulnerability as the original hpack as documented in https://github.com/mlalic/hpack-rs/issues/11

Details

The original includes a very nice description of the problem, as well as an easy-enough fix for it.

PoC

The original example pretty much still applies:

use loona_hpack::Decoder;

pub fn main() {
    let input = &[0x3f];
    let mut decoder = Decoder::new();
    let _ = decoder.decode(input);
}

Impact

From the original: All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on [crates.io](https://crates.io/crates/hpack-patched) under the name hpack-patched. See [Cargo's documentation on overriding dependencies](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html) for more information.

Fixed in


          0.4.3

References

Updated Nov 05, 2024 · Source: OSV.dev

Sep 05, 2024

0.4.0 unknown

1 CVE

CVE-2024-51502 GHSA-7vm6-qwh5-9x44 Nov 04, 2024

loona-hpack Panic Vulnerability

Medium

Network Low Low

Summary

loona-hpack suffers from the same vulnerability as the original hpack as documented in https://github.com/mlalic/hpack-rs/issues/11

Details

The original includes a very nice description of the problem, as well as an easy-enough fix for it.

PoC

The original example pretty much still applies:

use loona_hpack::Decoder;

pub fn main() {
    let input = &[0x3f];
    let mut decoder = Decoder::new();
    let _ = decoder.decode(input);
}

Impact

From the original: All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on [crates.io](https://crates.io/crates/hpack-patched) under the name hpack-patched. See [Cargo's documentation on overriding dependencies](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html) for more information.

Fixed in


          0.4.3

References

Updated Nov 05, 2024 · Source: OSV.dev

Aug 21, 2024

0.3.2 unknown

1 CVE

CVE-2024-51502 GHSA-7vm6-qwh5-9x44 Nov 04, 2024

loona-hpack Panic Vulnerability

Medium

Network Low Low

Summary

loona-hpack suffers from the same vulnerability as the original hpack as documented in https://github.com/mlalic/hpack-rs/issues/11

Details

The original includes a very nice description of the problem, as well as an easy-enough fix for it.

PoC

The original example pretty much still applies:

use loona_hpack::Decoder;

pub fn main() {
    let input = &[0x3f];
    let mut decoder = Decoder::new();
    let _ = decoder.decode(input);
}

Impact

From the original: All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on [crates.io](https://crates.io/crates/hpack-patched) under the name hpack-patched. See [Cargo's documentation on overriding dependencies](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html) for more information.

Fixed in


          0.4.3

References

Updated Nov 05, 2024 · Source: OSV.dev

Aug 14, 2024

0.3.1 unknown

1 CVE

CVE-2024-51502 GHSA-7vm6-qwh5-9x44 Nov 04, 2024

loona-hpack Panic Vulnerability

Medium

Network Low Low

Summary

loona-hpack suffers from the same vulnerability as the original hpack as documented in https://github.com/mlalic/hpack-rs/issues/11

Details

The original includes a very nice description of the problem, as well as an easy-enough fix for it.

PoC

The original example pretty much still applies:

use loona_hpack::Decoder;

pub fn main() {
    let input = &[0x3f];
    let mut decoder = Decoder::new();
    let _ = decoder.decode(input);
}

Impact

From the original: All users who try to decode untrusted input using the Decoder are vulnerable to this exploit. A patched version of the crate is available on [crates.io](https://crates.io/crates/hpack-patched) under the name hpack-patched. See [Cargo's documentation on overriding dependencies](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html) for more information.

Fixed in


          0.4.3

References

Updated Nov 05, 2024 · Source: OSV.dev

Aug 14, 2024

Activity

Details