Описание
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic.
Отчет
The flaw has been marked as moderate instead of high like NVD QUICConn.HandleData buffers data and passes it to handlePostHandshakeMessage every time the buffer contains a complete message, while HandleData doesn't limit the amount of data it can buffer, a panic or denial of service would likely be lower severity,also in order to exploit this vulnerability, an attacker would have to smuggle partial handshake data which might be rejected altogether as per tls RFC specification.Therfore because of a lower severity denial of service and conditions that are beyond the scope of attackers control,we have marked this as moderate severity
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| cert-manager Operator for Red Hat OpenShift | cert-manager/cert-manager-operator-rhel9 | Not affected | ||
| Cost Management Metrics Operator | costmanagement/costmanagement-metrics-rhel8-operator | Affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel8 | Not affected | ||
| Logical Volume Manager Storage | lvms4/topolvm-rhel9 | Affected | ||
| mirror registry for Red Hat OpenShift | mirror-registry-container | Will not fix | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel8-operator | Will not fix | ||
| Node Maintenance Operator | workload-availability/node-maintenance-rhel8-operator | Affected | ||
| OpenShift Developer Tools and Services | helm | Affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Affected | ||
| OpenShift Pipelines | openshift-pipelines-client | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
Processing an incomplete post-handshake message for a QUIC connection ...
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
Уязвимость функции HandleData() пакета crypto/tls языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3