CVE-2024-22189

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-22189
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-22189.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22189
Aliases
Related
Published
2024-04-04T15:15:37Z
Modified
2024-09-11T06:13:20.888636Z
Summary
[none]
Details

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

References

Affected packages

Debian:11 / golang-github-lucas-clemente-quic-go

Package

Name
golang-github-lucas-clemente-quic-go
Purl
pkg:deb/debian/golang-github-lucas-clemente-quic-go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.19.3-1
0.24.0-1
0.25.0-1
0.26.0-1~bpo11+1
0.26.0-1
0.29.0-1~bpo11+1
0.29.0-1~bpo11+2
0.29.0-1
0.29.2-1
0.29.2-2
0.29.2-3
0.37.0-1
0.37.4-1~bpo12+1
0.37.4-1
0.38.2-1
0.38.2-2
0.46.0-1
0.46.0-2~bpo12+1
0.46.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / golang-github-lucas-clemente-quic-go

Package

Name
golang-github-lucas-clemente-quic-go
Purl
pkg:deb/debian/golang-github-lucas-clemente-quic-go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.29.0-1
0.29.2-1
0.29.2-2
0.29.2-3
0.37.0-1
0.37.4-1~bpo12+1
0.37.4-1
0.38.2-1
0.38.2-2
0.46.0-1
0.46.0-2~bpo12+1
0.46.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / golang-github-lucas-clemente-quic-go

Package

Name
golang-github-lucas-clemente-quic-go
Purl
pkg:deb/debian/golang-github-lucas-clemente-quic-go?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.29.0-1
0.29.2-1
0.29.2-2
0.29.2-3
0.37.0-1
0.37.4-1~bpo12+1
0.37.4-1
0.38.2-1
0.38.2-2
0.46.0-1
0.46.0-2~bpo12+1
0.46.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/quic-go/quic-go

Affected ranges

Type
GIT
Repo
https://github.com/quic-go/quic-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4a99b816ae3ab03ae5449d15aac45147c85ed47a

Affected versions

v.*

v.0.21

v0.*

v0.21.0
v0.21.1
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.28.1
v0.29.0
v0.30.0
v0.31.0
v0.31.1
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.37.0
v0.37.1
v0.38.0
v0.38.1
v0.39.0
v0.4
v0.40.0
v0.41.0
v0.5.0
v0.6.0
v0.7.0