2232 matches found
RUSTSEC-2023-0063 Denial of service in Quinn servers
Receiving QUIC frames containing a frame with unknown frame type could lead to a panic. Unfortunately this is issue was not found by our fuzzing infrastructure. Thanks to the QUIC Tester research group for reporting this issue...
CVE-2023-42805: Improper Input Validation
quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases...
PT-2023-28591 · Unknown +1 · Quinn-Proto +1
Name of the Vulnerable Software and Affected Versions: quinn-proto versions prior to 0.9.5 quinn-proto versions prior to 0.10.5 Description: Receiving unknown QUIC frames in a QUIC packet could result in a panic. The issue was reported by the QUIC Tester research group and was not found by the...
SUSE-SU-2023:3701-1 Security update for go1.21
This update for go1.21 fixes the following issues: Update to go1.21.1 bsc1212475. - CVE-2023-39318: Fixed improper handling of HTML-like comments within script contexts in html/template bsc1215084. - CVE-2023-39319: Fixed improper handling of special tags within script contexts in html/template...
Golang < 1.20.8 / 1.21.x < 1.21.1 Multiple Vulnerabilities
The version of Golang Go installed on the remote host is affected by multiple vulnerabilities, including the following: - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory...
CVE-2023-39322
A flaw was found in Golang. QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With the fix, connections now consistently reject messages larger than 65KiB in size...
CVE-2023-39321
A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic...
CVE-2023-39321
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
CVE-2023-39322
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
Design/Logic Flaw
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
CVE-2023-39322
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
Code injection
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
CVE-2023-39321
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
UBUNTU-CVE-2023-39321
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
UBUNTU-CVE-2023-39322
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
CVE-2023-39322
CVE-2023-39322 concerns the QUIC-related handling in the Go crypto/tls implementation. The issue describes that QUIC connections did not bound the amount of data buffered when reading post-handshake messages, which could lead to unbounded memory growth. The associated fix enforces a maximum post-...
CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
CVE-2023-39322
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...
