ndpi:fuzz_quic_get_crypto_data: Heap-buffer-overflow in processClientServerHello

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4663656190377984 Project: ndpi Fuzzing Engine: afl Fuzz Target: fuzzquicgetcryptodata Job Type: aflasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x77d8f7be00b9 Crash...

ndpi:fuzz_quic_get_crypto_data: Use-of-uninitialized-value in ndpi_is_valid_hostname

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5067137556480000 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzquicgetcryptodata Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

ndpi:fuzz_quic_get_crypto_data: Heap-buffer-overflow in ndpi_is_valid_hostname

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4707178494885888 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzquicgetcryptodata Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2024-1765 Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche

Cloudflare Quiche through version 0.19.1/0.20.0 was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited numb...

CVE-2024-1765 Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche

Cloudflare Quiche through version 0.19.1/0.20.0 was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited numb...

quiche -- Multiple Vulnerabilities

Quiche Releases reports: This release includes 2 security fixes: CVE-2024-1410: Unbounded storage of information related to connection ID retirement, in quiche. Reported by Marten Seeman @marten-seeman CVE-2024-1765: Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche. Reported...