CVE-2023-22466
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-22466
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22466.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-22466
- Aliases
- Related
- Published
- 2023-01-04T22:15:09Z
- Modified
- 2025-01-14T11:30:56.919770Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting
pipe_modewill resetreject_remote_clientstofalse. If the application has previously configuredreject_remote_clientstotrue, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure thatpipe_modeis set first after initializing aServerOptions. - References
-
- https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7
- https://github.com/tokio-rs/tokio/pull/5336
- https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1
- https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients
- https://security-tracker.debian.org/tracker/CVE-2023-22466
Affected packages
Debian:12 / rust-tokio
Package
- Name
- rust-tokio
- Purl
- pkg:deb/debian/rust-tokio?arch=source
Debian:13 / rust-tokio
Package
- Name
- rust-tokio
- Purl
- pkg:deb/debian/rust-tokio?arch=source