CVE-2023-39322

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

CVE-2023-39321 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321

CVE-2023-39321 describes a panic caused by processing an incomplete post-handshake message in QUIC connections within the Go crypto/tls stack. Connected sources indicate the issue is fixed in Go crypto/tls (with related CVEs 2023-39322) and are referenced in advisories from F5 and AlmaLinux (ALSA...

CVE-2023-39321

Removed by vendor...

Google Golang Security Vulnerability

Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...

Google Go Security Vulnerability

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, USA. Go suffers from a security vulnerability that stems from the fact that QUIC connections do not set an upper limit on the amount of buffered data when reading post-handshake...

SSLVPN error "Websocket connection failed: Connection closed before receiving a handshake responser"

After VPN tunnel established to NetScaler gateway, user encounter access issue s to backend server with error message: "Websocket connection to 'ws:///ws/notification/site-msg/' failed: Connection closed before receiving a handshake responser"...

GO-2023-2044 Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

Uncaught Exception

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: Processing an incomplete post-handshake message for a QUIC connection can cause a panic. Remediation Upgrade std/crypto/tls to...

Allocation of Resources Without Limits or Throttling

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: QUIC connections do not set an upper bound on the amount of data buffered when reading...

SUSE CVE-2023-39322

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

SUSE CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

TCP option lost when traffic go through TCP type Load Balance(LB) Vserver

TCP option lost when traffic go through TCP type Load BalanceLB Vserver: 1. Clients send TCP syn to NetScaler with TCP option segment: 2. Backend Servers do not receive TCP handshake with TCP option segment from NetScaler:...

PT-2023-26883 · Quic +6 · Quic +6

Name of the Vulnerable Software and Affected Versions: QUIC affected versions not specified Description: The issue allows a malicious QUIC connection to cause unbounded memory growth due to the lack of an upper bound on the amount of data buffered when reading post-handshake messages. With the fi...

Security Bulletin: IBM Event Endpoint Management is vulnerable to a denial of service in Netty (CVE-2023-34462)

Summary Operator of IBM Event Endpoint Management is vulnerable to a denial of service in Netty 4.1.94 CVE-2023-34462 Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the...

CVE-2023-41180 Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default,...

Apache NiFi Trust Management Issues Vulnerability

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A trust management issue vulnerability exists in Apache NiFi MiNiFi C++ versions 0.13 through 0.14, which stems from...