CVE-2023-39322

🗓️ 08 Sep 2023 16:13:32Reported by GoType

QUIC connections unbounded memory growth issue fixe

Reporter	Title	Published	Views	Family All 229
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	5 Jun 202420:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	15 Apr 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go	30 Oct 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.0 has addressed security vulnerabilities	29 Nov 202322:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling contains a vulnerable yq package. [CVE-2023-39320, CVE-2023-39321 and CVE-2023-39322]	18 Mar 202414:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go	1 Jul 202405:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities discovered in IBM Security Verify Access Appliance	15 Apr 202502:38	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0101: container-tools:rhel8 (ALINUX3-SA-2024:0101)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : skopeo (ALSA-2023:7762)	15 Dec 202300:00	–	nessus

NVD

Node

golang goRange1.21.0–1.21.1

[
  {
    "vendor": "Go standard library",
    "product": "crypto/tls",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "crypto/tls",
    "versions": [
      {
        "version": "1.21.0-0",
        "lessThan": "1.21.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "QUICConn.HandleData"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
security	www.security.gentoo.org/glsa/202311-09
pkg	www.pkg.go.dev/vuln/GO-2023-2045
go	www.go.dev/issue/62266
groups	www.groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
go	www.go.dev/cl/523039
security	www.security.netapp.com/advisory/ntap-20231020-0004/

21 Nov 2024 08:15Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.00042

SSVC

CWE-770