Denial of service in quinn-proto when using `Endpoint::retry()`

🗓️ 03 Sep 2024 20:49:26Reported by GitHub Advisory DatabaseType

Denial of service risk in quinn-proto `Endpoint::retry()` leads to panic when unvalidated connection accepted and then `refuse()` or `ignore()` called. Also risk for DoS when initial packet fails to decrypt or exhausts connection IDs

Reporter	Title	Published	Views	Family All 20
Chainguard	CVE-2024-45311 vulnerabilities	2 Sep 202418:15	–	cgr
Circl	CVE-2024-45311	2 Sep 202421:24	–	circl
CNNVD	Quinn 安全漏洞	2 Sep 202400:00	–	cnnvd
CVE	CVE-2024-45311	2 Sep 202416:45	–	cve
Cvelist	CVE-2024-45311 Denial of service in quinn-proto when using `Endpoint::retry()`	2 Sep 202416:45	–	cvelist
Debian CVE	CVE-2024-45311	2 Sep 202416:45	–	debiancve
EUVD	EUVD-2024-2878	3 Oct 202520:07	–	euvd
NVD	CVE-2024-45311	2 Sep 202418:15	–	nvd
OSV	CGA-6J6X-XQQF-GXGJ	3 Oct 202417:22	–	osv
OSV	CGA-FMH7-XWQM-XF4P	25 Sep 202405:22	–	osv

Vulners

Node

quinn-protoRange0.11.0–0.11.7rust

Source	Link
github	www.github.com/quinn-rs/quinn/security/advisories/GHSA-vr26-jcq5-fjj8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45311
github	www.github.com/quinn-rs/quinn/commit/e01609ccd8738bd438d86fa7185a0f85598cb58f
github	www.github.com/quinn-rs/quinn/blob/bb02a12a8435a7732a1d762783eeacbb7e50418e/quinn-proto/src/endpoint.rs
github	www.github.com/quinn-rs/quinn
rustsec	www.rustsec.org/advisories/RUSTSEC-2024-0373.html
github	www.github.com/advisories/GHSA-vr26-jcq5-fjj8

09 Sep 2024 14:20Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00576

SSVC

CWE-670

quinn-proto endpoint::retry()server security denial of service