Bugzilla – Bug 1223240
VUL-0: CVE-2024-32650: spotifyd: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input
Last modified: 2024-04-29 14:36:32 UTC
spotifyd embeds rust-rustls: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32650 https://bugzilla.redhat.com/show_bug.cgi?id=2276085 https://www.cve.org/CVERecord?id=CVE-2024-32650 https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj
The current version of spotifyd is the latest available version 0.3.5. Although the reporter suggests that the vulnerability is fixed in lesser versions I'm assuming the fix is still there. Spotifyd isn't present in distributions Leap:15.5 and less.
(In reply to Dave Plater from comment #1) > The current version of spotifyd is the latest available version 0.3.5. > Although the reporter suggests that the vulnerability is fixed in lesser > versions I'm assuming the fix is still there. Spotifyd isn't present in > distributions Leap:15.5 and less. 0.20.x is affected according to the Github advisory: > Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj
I have no knowledge of rust and as far as spotify goes the only player that works for me is the snap pak I've found this commit message: Bump rustls from 0.21.10 to 0.21.11 Bumps [rustls](https://github.com/rustls/rustls) from 0.21.10 to 0.21.11. - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.21.10...v/0.21.11) So somebody needs to update spotifyd to the latest git
FWIW, spotifyd was dropped from FACTORY due to the long-time build error in the end, irrelevantly from this report itself.