UBUNTU-CVE-2024-22189

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2024-22189
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-22189.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-22189
Related
Published
2024-04-04T15:15:00Z
Modified
2024-04-04T15:15:00Z
Summary
[none]
Details

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

References

Affected packages

Ubuntu:22.04:LTS / golang-github-lucas-clemente-quic-go

Package

Name
golang-github-lucas-clemente-quic-go

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.18.0-3
0.24.0-1
0.25.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / golang-github-lucas-clemente-quic-go

Package

Name
golang-github-lucas-clemente-quic-go
Purl
pkg:deb/ubuntu/golang-github-lucas-clemente-quic-go@0.38.2-1?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.38.2-1

Affected versions

0.*

0.37.4-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "golang-github-lucas-clemente-quic-go-dev": "0.38.2-1"
        }
    ]
}