RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler thread and enabling remote denial of service of the metrics endpoint. This issue has been patched in version 1.0.0-alpha.78.
Weakness
The product does not handle or incorrectly handles an exceptional condition.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rustfs | Rustfs | 1.0.0-alpha13 (including) | 1.0.0-alpha13 (including) |
| Rustfs | Rustfs | 1.0.0-alpha14 (including) | 1.0.0-alpha14 (including) |
| Rustfs | Rustfs | 1.0.0-alpha15 (including) | 1.0.0-alpha15 (including) |
| Rustfs | Rustfs | 1.0.0-alpha16 (including) | 1.0.0-alpha16 (including) |
| Rustfs | Rustfs | 1.0.0-alpha17 (including) | 1.0.0-alpha17 (including) |
| Rustfs | Rustfs | 1.0.0-alpha18 (including) | 1.0.0-alpha18 (including) |
| Rustfs | Rustfs | 1.0.0-alpha19 (including) | 1.0.0-alpha19 (including) |
| Rustfs | Rustfs | 1.0.0-alpha20 (including) | 1.0.0-alpha20 (including) |
| Rustfs | Rustfs | 1.0.0-alpha21 (including) | 1.0.0-alpha21 (including) |
| Rustfs | Rustfs | 1.0.0-alpha22 (including) | 1.0.0-alpha22 (including) |
| Rustfs | Rustfs | 1.0.0-alpha23 (including) | 1.0.0-alpha23 (including) |
| Rustfs | Rustfs | 1.0.0-alpha24 (including) | 1.0.0-alpha24 (including) |
| Rustfs | Rustfs | 1.0.0-alpha25 (including) | 1.0.0-alpha25 (including) |
| Rustfs | Rustfs | 1.0.0-alpha26 (including) | 1.0.0-alpha26 (including) |
| Rustfs | Rustfs | 1.0.0-alpha27 (including) | 1.0.0-alpha27 (including) |
| Rustfs | Rustfs | 1.0.0-alpha28 (including) | 1.0.0-alpha28 (including) |
| Rustfs | Rustfs | 1.0.0-alpha29 (including) | 1.0.0-alpha29 (including) |
| Rustfs | Rustfs | 1.0.0-alpha30 (including) | 1.0.0-alpha30 (including) |
| Rustfs | Rustfs | 1.0.0-alpha31 (including) | 1.0.0-alpha31 (including) |
| Rustfs | Rustfs | 1.0.0-alpha32 (including) | 1.0.0-alpha32 (including) |
| Rustfs | Rustfs | 1.0.0-alpha33 (including) | 1.0.0-alpha33 (including) |
| Rustfs | Rustfs | 1.0.0-alpha34 (including) | 1.0.0-alpha34 (including) |
| Rustfs | Rustfs | 1.0.0-alpha35 (including) | 1.0.0-alpha35 (including) |
| Rustfs | Rustfs | 1.0.0-alpha36 (including) | 1.0.0-alpha36 (including) |
| Rustfs | Rustfs | 1.0.0-alpha37 (including) | 1.0.0-alpha37 (including) |
| Rustfs | Rustfs | 1.0.0-alpha38 (including) | 1.0.0-alpha38 (including) |
| Rustfs | Rustfs | 1.0.0-alpha39 (including) | 1.0.0-alpha39 (including) |
| Rustfs | Rustfs | 1.0.0-alpha40 (including) | 1.0.0-alpha40 (including) |
| Rustfs | Rustfs | 1.0.0-alpha41 (including) | 1.0.0-alpha41 (including) |
| Rustfs | Rustfs | 1.0.0-alpha42 (including) | 1.0.0-alpha42 (including) |
| Rustfs | Rustfs | 1.0.0-alpha43 (including) | 1.0.0-alpha43 (including) |
| Rustfs | Rustfs | 1.0.0-alpha44 (including) | 1.0.0-alpha44 (including) |
| Rustfs | Rustfs | 1.0.0-alpha45 (including) | 1.0.0-alpha45 (including) |
| Rustfs | Rustfs | 1.0.0-alpha46 (including) | 1.0.0-alpha46 (including) |
| Rustfs | Rustfs | 1.0.0-alpha47 (including) | 1.0.0-alpha47 (including) |
| Rustfs | Rustfs | 1.0.0-alpha48 (including) | 1.0.0-alpha48 (including) |
| Rustfs | Rustfs | 1.0.0-alpha49 (including) | 1.0.0-alpha49 (including) |
| Rustfs | Rustfs | 1.0.0-alpha50 (including) | 1.0.0-alpha50 (including) |
| Rustfs | Rustfs | 1.0.0-alpha51 (including) | 1.0.0-alpha51 (including) |
| Rustfs | Rustfs | 1.0.0-alpha52 (including) | 1.0.0-alpha52 (including) |
| Rustfs | Rustfs | 1.0.0-alpha53 (including) | 1.0.0-alpha53 (including) |
| Rustfs | Rustfs | 1.0.0-alpha54 (including) | 1.0.0-alpha54 (including) |
| Rustfs | Rustfs | 1.0.0-alpha55 (including) | 1.0.0-alpha55 (including) |
| Rustfs | Rustfs | 1.0.0-alpha56 (including) | 1.0.0-alpha56 (including) |
| Rustfs | Rustfs | 1.0.0-alpha57 (including) | 1.0.0-alpha57 (including) |
| Rustfs | Rustfs | 1.0.0-alpha58 (including) | 1.0.0-alpha58 (including) |
| Rustfs | Rustfs | 1.0.0-alpha59 (including) | 1.0.0-alpha59 (including) |
| Rustfs | Rustfs | 1.0.0-alpha6 (including) | 1.0.0-alpha6 (including) |
| Rustfs | Rustfs | 1.0.0-alpha60 (including) | 1.0.0-alpha60 (including) |
| Rustfs | Rustfs | 1.0.0-alpha61 (including) | 1.0.0-alpha61 (including) |
| Rustfs | Rustfs | 1.0.0-alpha62 (including) | 1.0.0-alpha62 (including) |
| Rustfs | Rustfs | 1.0.0-alpha63 (including) | 1.0.0-alpha63 (including) |
| Rustfs | Rustfs | 1.0.0-alpha64 (including) | 1.0.0-alpha64 (including) |
| Rustfs | Rustfs | 1.0.0-alpha65 (including) | 1.0.0-alpha65 (including) |
| Rustfs | Rustfs | 1.0.0-alpha66 (including) | 1.0.0-alpha66 (including) |
| Rustfs | Rustfs | 1.0.0-alpha67 (including) | 1.0.0-alpha67 (including) |
| Rustfs | Rustfs | 1.0.0-alpha68 (including) | 1.0.0-alpha68 (including) |
| Rustfs | Rustfs | 1.0.0-alpha69 (including) | 1.0.0-alpha69 (including) |
| Rustfs | Rustfs | 1.0.0-alpha70 (including) | 1.0.0-alpha70 (including) |
| Rustfs | Rustfs | 1.0.0-alpha71 (including) | 1.0.0-alpha71 (including) |
| Rustfs | Rustfs | 1.0.0-alpha72 (including) | 1.0.0-alpha72 (including) |
| Rustfs | Rustfs | 1.0.0-alpha73 (including) | 1.0.0-alpha73 (including) |
| Rustfs | Rustfs | 1.0.0-alpha74 (including) | 1.0.0-alpha74 (including) |
| Rustfs | Rustfs | 1.0.0-alpha75 (including) | 1.0.0-alpha75 (including) |
| Rustfs | Rustfs | 1.0.0-alpha76 (including) | 1.0.0-alpha76 (including) |
| Rustfs | Rustfs | 1.0.0-alpha77 (including) | 1.0.0-alpha77 (including) |