Количество 11
Количество 11
GHSA-c33x-xqrf-c478
QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack
CVE-2024-22189
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.
CVE-2024-22189
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.
CVE-2024-22189
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.
CVE-2024-22189
CVE-2024-22189
quic-go is an implementation of the QUIC protocol in Go. Prior to vers ...
BDU:2024-03135
Уязвимость реализации протокола QUIC библиотеки quic-go языка программирования go, связанная с неограниченным распределением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
openSUSE-SU-2024:0220-1
Security update for caddy
openSUSE-SU-2024:0211-1
Security update for caddy
openSUSE-RU-2026:21160-1
Recommended update for dnscrypt-proxy
openSUSE-SU-2024:0319-1
Security update for coredns
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-c33x-xqrf-c478 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад |
 | CVE-2024-22189 quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад |
 | CVE-2024-22189 quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад |
 | CVE-2024-22189 quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад |
 | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад | |
| CVE-2024-22189 quic-go is an implementation of the QUIC protocol in Go. Prior to vers ... | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад |
 | BDU:2024-03135 Уязвимость реализации протокола QUIC библиотеки quic-go языка программирования go, связанная с неограниченным распределением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 1% Низкий | больше 2 лет назад |
 | openSUSE-SU-2024:0220-1 Security update for caddy | около 2 лет назад | ||
| openSUSE-SU-2024:0211-1 Security update for caddy | около 2 лет назад | ||
| openSUSE-RU-2026:21160-1 Recommended update for dnscrypt-proxy | около 2 месяцев назад | ||
| openSUSE-SU-2024:0319-1 Security update for coredns | почти 2 года назад |
Уязвимостей на страницу