GHSA-3q6m-v84f-6p9h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3q6m-v84f-6p9h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-3q6m-v84f-6p9h/GHSA-3q6m-v84f-6p9h.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3q6m-v84f-6p9h
- Aliases
- Published
- 2023-10-30T15:08:05Z
- Modified
- 2023-11-08T04:13:41.556465Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- quic-go vulnerable to pointer dereference that can lead to panic
- Details
-
quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.
Impact
An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.
Patches
v0.37.3 contains a patch. Versions before v0.37.0 are not affected.
- Database specific
{ "github_reviewed_at": "2023-10-30T15:08:05Z", "github_reviewed": true, "severity": "HIGH", "nvd_published_at": "2023-10-31T16:15:09Z", "cwe_ids": [ "CWE-248", "CWE-476" ] }- References
Affected packages
Go / github.com/quic-go/quic-go
Package
- Name
- github.com/quic-go/quic-go
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/quic-go/quic-go