We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-46239

quic-go vulnerable to pointer dereference that can lead to panic



AssignerGitHub_M
Reserved2023-10-19
Published2023-10-31
Updated2024-09-05

Description

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.



HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-248: Uncaught Exception

Product status

>= 0.37.0, < 0.37.3
affected

References

https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h

https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617

https://github.com/quic-go/quic-go/releases/tag/v0.37.3

cve.org CVE-2023-46239

nvd.nist.gov CVE-2023-46239

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-46239
Subscribe to our newsletter to learn more about our work.