RUSTSEC-2017-0005

Large cookie Max-Age values can cause a denial of service

Reported

May 6, 2017

Issued

October 1, 2020 (last modified: June 13, 2023)

Package

cookie (crates.io)

Type

Vulnerability

Keywords

#crash

Aliases

References

https://github.com/alexcrichton/cookie-rs/pull/86

CVSS Score

7.5 HIGH

CVSS Details

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

<0.6.0
^0.6.2
>=0.7.6

Description

Affected versions of this crate use the time crate and the method Duration::seconds to parse the Max-Age duration cookie setting. This method will panic if the value is greater than 2^64/1000 and less than or equal to 2^64, which can result in denial of service for a client or server.

This flaw was corrected by explicitly checking for the Max-Age being in this integer range and clamping the value to the maximum duration value.

Advisory available under CC0-1.0 license.