Description
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.
Published: 2023-10-31
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-2633 quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.
Github GHSA Github GHSA GHSA-3q6m-v84f-6p9h quic-go vulnerable to pointer dereference that can lead to panic
History

No history.

Subscriptions

Quic-go Project Quic-go
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-09-05T17:37:20.453Z

Reserved: 2023-10-19T20:34:00.947Z

Link: CVE-2023-46239

cve-icon Vulnrichment

Updated: 2024-08-02T20:37:40.330Z

cve-icon NVD

Status : Modified

Published: 2023-10-31T16:15:09.543

Modified: 2024-11-21T08:28:08.667

Link: CVE-2023-46239

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses