CVE-2024-11738
Fixed in a distro release EPSS <1%CVSS 5.3
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
Products: Red Hat Trusted Artifact Signer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| crates.io | rustls | 0.23.18 |
| crates.io | rustls | 0.23.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | himmelblau | 2.3.9+git0.a9fd29b-150700.3.15.1 |
| Ubuntu 24.04 LTS | rust-rustls | no fix |
| Ubuntu 25.10 | rust-rustls | no fix |
| Ubuntu 26.04 LTS | rust-rustls | no fix |
| Ubuntu 26.10 | rust-rustls | no fix |
| openSUSE Tumbleweed | himmelblau | 0.7.7+git.0.b48d0bb-1.1 |