Description (CNA)
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| quic-go / quic-go | affected >= 0.37.0, < 0.37.3 |
CWE
CWE-248
References
- https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h
- https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617
- https://github.com/quic-go/quic-go/releases/tag/v0.37.3
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.