PT-2024-14011 · Quic · Quic

Published 2024-02-20 · Updated 2024-12-04 · CVE-2023-50923

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions QUIC in RFC 9000 (affected versions not specified)

Description The Latency Spin Bit specification in QUIC does not strictly constrain the bit value when the feature is disabled. This might allow remote attackers to construct a covert channel with data represented as changes to the bit value. According to a research paper, modern internet communication protocols provide numerous ways to hide or embed data within normal network traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-50923

Affected Products

Quic

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-50923 · Security Note
• https://t.me/cvenotify/72055 · Telegram Post
• https://twitter.com/CVEnew/status/1760083524428890180 · Twitter Post
• https://t.me/cvenotify/103055 · Telegram Post
• https://ieeexplore.ieee.org/document/10427406 · Note
• https://arrow.tudublin.ie/nsdcon/2 · Note
• https://t.me/cvenotify/72253 · Telegram Post
• https://rfc-editor.org/rfc/rfc9000.html · Note