CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"1.21.0"},{"fixed":"1.21.1"}]}]

Références

advisory security.gentoo.org
advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev