CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"1.21.0"},{"fixed":"1.21.1"}]}]

参照URL

advisory security.gentoo.org
advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev