quic-go vulnerable to pointer dereference that can lead to panic
Résumé
quic-go vulnerable to pointer dereference that can lead to panic
Description d'origine
La description telle que publiée par la source (souvent en anglais).
quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.
Impact
An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.
Patches
v0.37.3 contains a patch. Versions before v0.37.0 are not affected.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Ubuntu UBUNTU-CVE-2023-46239 golang-github-lucas-clemente-quic-go
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com