{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-39322", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2023-07-27T17:05:55.187Z", "datePublished": "2023-09-08T16:13:32.795Z", "dateUpdated": "2023-10-11T21:14:59.364Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2023-10-11T21:14:59.364Z"}, "title": "Memory exhaustion in QUIC connection handling in crypto/tls", "descriptions": [{"lang": "en", "value": "QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size."}], "affected": [{"vendor": "Go standard library", "product": "crypto/tls", "collectionURL": "https://pkg.go.dev", "packageName": "crypto/tls", "versions": [{"version": "1.21.0-0", "lessThan": "1.21.1", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "QUICConn.HandleData"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "references": [{"url": "https://go.dev/issue/62266"}, {"url": "https://go.dev/cl/523039"}, {"url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"}, {"url": "https://pkg.go.dev/vuln/GO-2023-2045"}, {"url": "https://security.netapp.com/advisory/ntap-20231020-0004/"}, {"url": "https://security.gentoo.org/glsa/202311-09"}], "credits": [{"lang": "en", "value": "Marten Seemann"}]}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "matchCriteriaId": "958E1BA0-2840-47E9-A790-79C10164C68C", "versionEndExcluding": "1.21.1", "versionStartIncluding": "1.21.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size."}, {"lang": "es", "value": "Las conexiones QUIC no establecen un l\u00edmite superior en la cantidad de datos almacenados en el b\u00fafer al leer mensajes post-handshake, lo que permite que una conexi\u00f3n QUIC maliciosa provoque un crecimiento ilimitado de la memoria. Con la soluci\u00f3n aplicada, las conexiones ahora rechazan sistem\u00e1ticamente los mensajes de m\u00e1s de 65 KiB de tama\u00f1o."}], "id": "CVE-2023-39322", "lastModified": "2023-11-25T11:15:17.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-08T17:15:28.120", "references": [{"source": "security@golang.org", "tags": ["Patch"], "url": "https://go.dev/cl/523039"}, {"source": "security@golang.org", "tags": ["Issue Tracking"], "url": "https://go.dev/issue/62266"}, {"source": "security@golang.org", "tags": ["Mailing List", "Release Notes"], "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"}, {"source": "security@golang.org", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2023-2045"}, {"source": "security@golang.org", "url": "https://security.gentoo.org/glsa/202311-09"}, {"source": "security@golang.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}