CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

CVE-2023-39322

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321

CVE-2023-39321 describes a panic caused by processing an incomplete post-handshake message in QUIC connections within the Go crypto/tls stack. Connected sources indicate the issue is fixed in Go crypto/tls (with related CVEs 2023-39322) and are referenced in advisories from F5 and AlmaLinux (ALSA...

CVE-2023-39321 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321

Removed by vendor...

CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39322: Allocation of Resources Without Limits or Throttling

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

CVE-2023-39321: Uncontrolled Resource Consumption

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

Google Go Security Vulnerability

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, USA. Go suffers from a security vulnerability that stems from the fact that QUIC connections do not set an upper limit on the amount of buffered data when reading post-handshake...

GO-2023-2044 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

Allocation of Resources Without Limits or Throttling

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: QUIC connections do not set an upper bound on the amount of data buffered when reading...

GO-2023-2045 Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

SUSE CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

SUSE CVE-2023-39322

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

FreeBSD : go -- multiple vulnerabilities (beb36f39-4d74-11ee-985e-bff341e78d94)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the beb36f39-4d74-11ee-985e-bff341e78d94 advisory. - The Go project reports: cmd/go: go.mod toolchain directive allows arbitrary execution The...

PT-2023-26883

Name of the Vulnerable Software and Affected Versions QUIC affected versions not specified Description The issue allows a malicious QUIC connection to cause unbounded memory growth due to the lack of an upper bound on the amount of data buffered when reading post-handshake messages. With the fix...

go -- multiple vulnerabilities

The Go project reports: cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to...