crates.io/websocket CVE-2022-35922: high 7.5, EPSS 1.92%

Rust-WebSocket memory allocation based on untrusted length

Action: Upgrade websocket to 0.26.5 or later.

cargo update -p websocket --precise 0.26.5

Affected

Fixed versions

Sources

• osv: GHSA-qrjv-rf5q-qpxc
• https://github.com/websockets-rs/rust-websocket/security/advisories/GHSA-qrjv-rf5q-qpxc
• https://nvd.nist.gov/vuln/detail/CVE-2022-35922
• https://github.com/websockets-rs/rust-websocket/commit/cbf6e9983e839d2ecad86de8cd1b3f20ed43390b
• https://github.com/websockets-rs/rust-websocket
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V2EOOU5OLEHVMKAH6BALQXKDKIZRXCI
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYPNCM4H4OFBIZI6XMJ2DUTS54FT2TWP
• https://rustsec.org/advisories/RUSTSEC-2022-0035.html

CVE-2022-35922 · published 2022-08-06T05:20:00Z · modified 2023-11-08T04:09:52.795702Z · JSON