CVE-2024-53259 quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IPPMTUDISCDO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceed...

CVE-2024-53259

CVE-2024-53259 affects the quic-go QUIC implementation. An off-path attacker can inject an ICMP Packet Too Large when IP_PMTUDISC_DO is used, causing the kernel to return a “message too large” error on sendmsg if a QUIC packet exceeds the MTU claimed in the ICMP message. This can disrupt a QUIC c...

quic-go 数据伪造问题漏洞

quic-go is an implementation of the QUIC protocol, RFC 9000 protocol in Go by Lucas Clemente, a personal developer. A data forgery issue vulnerability exists in versions of quic-go prior to v0.48.1, which stems from the mishandling of ICMP Packet Too Large messages, and could allow an out-of-path...

HTTP/3 support in Reactor 2024.0 Release Train

HTTP/3, the latest major version of the Hypertext Transfer Protocol, had its specification finalized in June 2022. This version is designed to enhance performance, reliability, and security. Unlike its predecessors, HTTP/3 utilizes QUIC instead of TCP as its transport layer. QUIC is a UDP-based,...

CVE-2024-52811

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811 Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811 Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

PT-2024-9120 · Quic-Go +1 · Quic-Go +1

Name of the Vulnerable Software and Affected Versions: quic-go versions prior to 0.48.2 Description: An off-path attacker can inject an ICMP Packet Too Large packet, disrupting a QUIC connection by setting the MTU value to smaller than 1200 bytes. This can be done after the handshake completion,...

msgtrans (>=0.1.0 <=0.1.6), s2n-quic (>=1.18.0 <=1.37.0) +3 more potentially affected by unknown CVE via s2n-tls (>=0.0.10 <=0.3.1)

s2n-tls CARGO version =0.0.10, =0.1.0, =1.18.0, =0.18.2, =0.18.2, =0.0.6, =0.3.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RP9H-RF7G-HWGR...

Fedora 41 : golang-github-quic (2024-62fc2aa0aa)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-62fc2aa0aa advisory. Automatic update for golang-github-quic-0.42.0-1.fc41. Changelog Sat Mar 23 2024 Mikel Olasagasti Uranga - 0.42.0-1 - Update to 0.42.0 - Closes rhbz2240724...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

BIT-HAPROXY-2024-49214

QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality...

The vulnerability of the Suricata intrusion detection and prevention system arises from errors in checking the JA4 identifier, which provides information about the application protocol used between the client and the server. This vulnerability allows attackers to trigger a service failure.

The vulnerability of the Suricata intrusion detection and prevention system is related to errors in checking the JA4 identifier, which provides information about the application protocol used between the client and the server. Exploiting this vulnerability allows a malicious actor to cause servic...

OESA-2024-2273 haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fixes: QUIC in HAProxy...

CVE-2024-47522

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. O...

CVE-2024-47522 Suricata ja4: invalid alpn leads to panic

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. O...

CVE-2024-47522 Suricata ja4: invalid alpn leads to panic

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. O...

CVE-2024-47522 Suricata ja4: invalid alpn leads to panic

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. O...

CVE-2024-47522

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can lead to Suricata aborting with a panic. This issue has been addressed in 7.0.7. O...

CVE-2024-47522

CVE-2024-47522 affects Suricata (network IDS/IPS/NSM). The issue: invalid ALPN in TLS/QUIC traffic when JA4 matching/logging is enabled can cause Suricata to abort with a panic. It is fixed in version 7.0.7; upgrading to 7.0.7 or later mitigates the flaw. A temporary workaround is to disable JA4 ...