RUSTSEC-2023-0001: reject_remote_clients Configuration corruption #1156
Description
reject_remote_clients Configuration corruption
| Details | |
|---|---|
| Package | tokio |
| Version | 1.21.2 |
| URL | GHSA-7rrj-xr53-82p7 |
| Date | 2023-01-04 |
| Patched versions | >=1.18.4, <1.19.0,>=1.20.3, <1.21.0,>=1.23.1 |
| Unaffected versions | <1.7.0 |
On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.
This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.
The default setting of reject_remote_clients is normally true meaning the default is also overriden as false.
Workarounds
Ensure that pipe_mode is set first after initializing a ServerOptions. For example:
let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);See advisory page for additional details.