HistoryEdit

RUSTSEC-2023-0001

reject_remote_clients Configuration corruption

Reported
Issued
Package
tokio (crates.io)
Type
Vulnerability
Keywords
#configuration-failure
Aliases
Details
https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7
Patched
  • >=1.18.4, <1.19.0
  • >=1.20.3, <1.21.0
  • >=1.23.1
Unaffected
  • <1.7.0
Affected OSes
  • windows

Description

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overriden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);