Loading vulnerability details...
When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.
Both TLS clients and TLS servers that accept client certificate are affected.
This was previously reported in https://github.com/briansmith/webpki/issues/69.
rustls-webpki is a fork of this crate which contains a fix for this issue and is actively maintained.
When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.
Both TLS clients and TLS servers that accept client certificate are affected.
This was previously reported in https://github.com/briansmith/webpki/issues/69.
rustls-webpki is a fork of this crate which contains a fix for this issue and is actively maintained.
This high-severity vulnerability could allow attackers to gain unauthorized access, execute arbitrary code, or compromise data integrity. Prompt remediation is strongly recommended.
Apply security patches to version 0.22.2 immediately
Isolate affected systems from untrusted networks until patching is complete
Implement enhanced monitoring for exploitation attempts and unusual behavior