PT-2023-28591 · Unknown+1 · Quinn-Proto+1

Quictester · Publicado 2023-09-21 · Atualizado 2023-09-25 · CVE-2023-42805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions quinn-proto versions prior to 0.9.5 quinn-proto versions prior to 0.10.5

Description Receiving unknown QUIC frames in a QUIC packet could result in a panic. The issue was reported by the QUIC Tester research group and was not found by the fuzzing infrastructure.

Recommendations For quinn-proto versions prior to 0.9.5, update to version 0.9.5 or later to resolve the issue. For quinn-proto versions prior to 0.10.5, update to version 0.10.5 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-42805

GHSA-Q8WC-J5M9-27W3

RUSTSEC-2023-0063

Produtos afetados

Debian

Quinn-Proto

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42805.json · Exploit
• https://github.com/quinn-rs/quinn · Nota
• https://github.com/quinn-rs/quinn/pull/1667 · Correção
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3 · Aviso do Fabricante
• https://github.com/quinn-rs/quinn/pull/1668 · Correção
• https://github.com/quinn-rs/quinn/pull/1669 · Nota
• https://t.me/cibsecurity/70908 · Publicação no Telegram
• https://osv.dev/vulnerability/RUSTSEC-2023-0063 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-42805 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1704931512464933377 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1704901539658093023 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-42805 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42805 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-42805 · Aviso do Fabricante
• https://crates.io/crates/quinn-proto · Nota