Platform
rust
Component
cookie
Fixed in
0.7.6
0.6.2
0.6.2
CVE-2017-18589 is a denial-of-service (DoS) vulnerability affecting the Rust 'cookie' crate. The vulnerability arises from the crate's use of the time crate's Duration::seconds method to parse the Max-Age cookie setting, which can panic if the value exceeds a specific range. This can lead to a crash of the client or server processing the cookie, resulting in a DoS condition. Affected versions are those prior to 0.6.2; the vulnerability was resolved by adding explicit range checks and clamping the value.
An attacker could exploit this vulnerability by sending a crafted HTTP response containing a Set-Cookie header with a maliciously large Max-Age value. This value, when parsed by the affected 'cookie' crate, would trigger a panic, causing the application to crash or become unresponsive. The impact is a denial of service, potentially disrupting the availability of the application or service. The blast radius is limited to the application instance processing the malicious cookie; however, a coordinated attack could target multiple instances to amplify the impact. This vulnerability highlights the importance of validating all external inputs, including cookie values, to prevent unexpected behavior and potential crashes.
CVE-2017-18589 was published on May 6, 2017. There is no indication of this vulnerability being actively exploited in the wild. It is not listed on KEV or EPSS. Public proof-of-concept (POC) code is available, demonstrating the vulnerability's exploitability. The relatively low complexity of the exploit and the widespread use of the 'cookie' crate mean that it remains a potential risk if not addressed.
Exploit Status
EPSS
0.33% (56% percentile)
CVSS Vector
The primary mitigation for CVE-2017-18589 is to upgrade the 'cookie' crate to version 0.6.2 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing input validation on the server-side to restrict the maximum value allowed for the Max-Age cookie. Specifically, ensure that the Max-Age value is within a reasonable range (e.g., less than 2^31 seconds). Web application firewalls (WAFs) configured to inspect HTTP headers could also be used to block requests with excessively large Max-Age values. After upgrading, confirm the fix by sending a request with a large Max-Age value and verifying that the application does not panic.
No official patch available. Check for workarounds or monitor for updates.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2017-18589 is a denial-of-service vulnerability in the Rust 'cookie' crate where parsing large 'Max-Age' cookie values can cause a panic, leading to service disruption. It has a CVSS score of 7.5 (HIGH).
You are affected if you are using the 'cookie' crate in Rust and have a version prior to 0.6.2. Check your project's dependencies to determine if an upgrade is needed.
Upgrade the 'cookie' crate to version 0.6.2 or later. Alternatively, implement input validation to restrict the maximum Max-Age cookie value.
There is no public evidence of CVE-2017-18589 being actively exploited in the wild, but the vulnerability remains a potential risk.
Refer to the Rust 'cookie' crate's repository and related discussions for information about this vulnerability: https://github.com/rust-lang/cookie
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your Cargo.lock file and we'll tell you instantly if you're affected.