tf-encrypted / moose

Secure distributed dataflow framework for encrypted machine learning and data processing
Apache License 2.0
56 stars 15 forks source link

RUSTSEC-2023-0001: reject_remote_clients Configuration corruption #1156

Open github-actions[bot] opened 1 year ago

github-actions[bot] commented 1 year ago

reject_remote_clients Configuration corruption

Details
Package tokio
Version 1.21.2
URL https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7
Date 2023-01-04
Patched versions >=1.18.4, <1.19.0,>=1.20.3, <1.21.0,>=1.23.1
Unaffected versions <1.7.0

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overriden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

See advisory page for additional details.