h3 0.0.6

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate `h3`

Dependencies

(7 total, 1 possibly insecure)

Crate	Required	Latest	Status
bytes	`^1`	`1.9.0`	up to date
fastrand	`^2.0.1`	`2.3.0`	up to date
futures-util	`^0.3`	`0.3.31`	up to date
http	`^1`	`1.2.0`	up to date
pin-project-lite	`^0.2`	`0.2.15`	up to date
tokio ⚠️	`^1`	`1.42.0`	maybe insecure
tracing	`^0.1.40`	`0.1.41`	up to date

Dev dependencies

(11 total, 3 possibly insecure)

Crate	Required	Latest	Status
assert_matches	`^1.5.0`	`1.5.0`	up to date
futures	`^0.3.28`	`0.3.31`	up to date
futures-util	`^0.3`	`0.3.31`	up to date
proptest	`^1`	`1.5.0`	up to date
quinn	`^0.11`	`0.11.6`	up to date
quinn-proto ⚠️	`^0.11`	`0.11.9`	maybe insecure
rcgen	`^0.13`	`0.13.1`	up to date
rustls ⚠️	`^0.23`	`0.23.20`	maybe insecure
tokio ⚠️	`^1`	`1.42.0`	maybe insecure
tokio-util	`^0.7.9`	`0.7.13`	up to date
tracing-subscriber	`^0.3`	`0.3.19`	up to date

Security Vulnerabilities

`tokio`: reject_remote_clients Configuration corruption

RUSTSEC-2023-0001

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overridden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

`quinn-proto`: `Endpoint::retry()` calls can lead to panicking

RUSTSEC-2024-0373

In 0.11.0, we overhauled the server-side Endpoint implementation to enable more careful handling of incoming connection attempts. However, some of the code paths that cleaned up state after connection attempts were processed confused the initial destination connection ID with the destination connection ID of a substantial package. This resulted in the internal Endpoint state becoming inconsistent, which could then lead to a panic.

https://github.com/quinn-rs/quinn/commit/e01609ccd8738bd438d86fa7185a0f85598cb58f

Thanks to @finbear for reporting and investingating, and to @BiagoFesta for coordinating.

`rustls`: rustls network-reachable panic in `Acceptor::accept`

RUSTSEC-2024-0399

A bug introduced in rustls 0.23.13 leads to a panic if the received TLS ClientHello is fragmented. Only servers that use rustls::server::Acceptor::accept() are affected.

Servers that use tokio-rustls's LazyConfigAcceptor API are affected.

Servers that use tokio-rustls's TlsAcceptor API are not affected.

Servers that use rustls-ffi's rustls_acceptor_accept API are affected.

Crate h3