CVE-2023-39322
Summary
| CVE | CVE-2023-39322 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-08 17:15:00 UTC |
| Updated | 2023-11-07 04:17:00 UTC |
| Description | QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size. |
Risk And Classification
Problem Types: CWE-770
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GO-2023-2045 - Go Packages | MISC | pkg.go.dev | |
| crypto/tls: panic when processing partial post-handshake message in QUICConn.HandleData · Issue #62266 · golang/go · GitHub | MISC | go.dev | |
| [security] Go 1.21.1 and Go 1.20.8 are released | MISC | groups.google.com | |
| September 2023 Golang 1.21.0 Vulnerabilities in NetApp Products | NetApp Product Security | MISC | security.netapp.com | |
| go.dev/cl/523039 | MISC | go.dev | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161230 Oracle Enterprise Linux Security Update for podman (ELSA-2023-7765)
- 161231 Oracle Enterprise Linux Security Update for containernetworking-plugins (ELSA-2023-7766)
- 161240 Oracle Enterprise Linux Security Update for runc (ELSA-2023-7763)
- 161243 Oracle Enterprise Linux Security Update for skopeo (ELSA-2023-7762)
- 161244 Oracle Enterprise Linux Security Update for buildah (ELSA-2023-7764)
- 161289 Oracle Enterprise Linux Security Update for container-tools:4.0 (ELSA-2024-0121)
- 242374 Red Hat OpenShift Container Platform 4.14 Security Update (RHSA-2023:5009)
- 242464 Red Hat OpenShift Container Platform 4.14 Security Update (RHSA-2023:6840)
- 242569 Red Hat Update for podman (RHSA-2023:7765)
- 242584 Red Hat Update for runc (RHSA-2023:7763)
- 242585 Red Hat Update for containernetworking-plugins (RHSA-2023:7766)
- 242587 Red Hat Update for buildah (RHSA-2023:7764)
- 242593 Red Hat Update for skopeo (RHSA-2023:7762)
- 242882 Red Hat Update for container-tools:4.0 (RHSA-2024:0121)
- 296105 Oracle Solaris 11.4 Support Repository Update (SRU) 63.157.1 Missing (CPUOCT2023)
- 506086 Alpine Linux Security Update for go
- 710791 Gentoo Linux Go Multiple Vulnerabilities (GLSA 202311-09)
- 754886 SUSE Enterprise Linux Security Update for go1.21 (SUSE-SU-2023:3701-1)
- 755275 SUSE Enterprise Linux Security Update for go1.21-openssl (SUSE-SU-2023:4469-1)
- 770213 Red Hat OpenShift Container Platform 4.14 Security Update (RHSA-2023:5009)
- 770214 Red Hat OpenShift Container Platform 4.14 Security Update (RHSA-2023:6840)
- 941495 AlmaLinux Security Update for podman (ALSA-2023:7765)
- 941497 AlmaLinux Security Update for runc (ALSA-2023:7763)
- 941498 AlmaLinux Security Update for containernetworking-plugins (ALSA-2023:7766)
- 941499 AlmaLinux Security Update for skopeo (ALSA-2023:7762)
- 941500 AlmaLinux Security Update for buildah (ALSA-2023:7764)
- 941535 AlmaLinux Security Update for container-tools:4.0 (ALSA-2024:0121)