Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tonic is a native gRPC client & server implementation with async/await support. When using     tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on     accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that     were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains     the fix. (CVE-2024-47609)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-347164df1c advisory.

    - Update the hyper-rustls crate to version 0.27.3.
    - Update the reqwest crate to version 0.12.8.
    - Update the rustls-native-certs crate to version 0.8.0 and add a compat package for version 0.7.
    - Update the tonic, tonic-build, and tonic-types crates to version 0.12.3.
    - Update the tower crate to version 0.5.1 and add a compat package for version 0.4.
    - Update the tower-http crate to version 0.6.1 and add a compat package for version 0.5.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ff98facbc6 advisory.

    - Update the hyper-rustls crate to version 0.27.3.
    - Update the reqwest crate to version 0.12.8.
    - Update the rustls-native-certs crate to version 0.8.0 and add a compat package for version 0.7.
    - Update the tonic, tonic-build, and tonic-types crates to version 0.12.3.
    - Update the tower crate to version 0.5.1 and add a compat package for version 0.4.
    - Update the tower-http crate to version 0.6.1 and add a compat package for version 0.5.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255934	Linux Distros Unpatched Vulnerability : CVE-2024-47609	Nessus	Misc.	high
211265	Fedora 41 : rust-hyper-rustls / rust-reqwest / rust-rustls-native-certs / etc (2024-347164df1c)	Nessus	Fedora Local Security Checks	medium
209319	Fedora 39 : rust-hyper-rustls / rust-reqwest / rust-rustls-native-certs / etc (2024-ff98facbc6)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2024-47609

medium

Tenable Plugins

high

medium

medium