CVE-2019-15541: rustls_project rustls Argument Injection

Vulnerability summary

CVE-2019-15541 is a high (CVSS 7.5) Argument Injection vulnerability in rustls_project rustls. EPSS estimates a 2.23% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-08-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.