PT-2024-21087 · Pquic · Pquic

Quictester · Published 2024-02-09 · Updated 2024-02-15 · CVE-2024-25679

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions PQUIC versions prior to 5bde5bb

Description The issue allows attackers to disrupt a connection with a PSK configuration by sending a CONNECTION CLOSE frame that is encrypted via the initial key computed. Network traffic sniffing is needed as part of exploitation.

Recommendations For versions prior to 5bde5bb, update to a version after 5bde5bb to resolve the issue. As a temporary workaround, consider restricting the use of the initial encryption key to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-324

Related Identifiers

CVE-2024-25679

Affected Products

Pquic

References · 8

• https://github.com/p-quic/pquic/pull/39 · Patch
• https://osv.dev/vulnerability/CVE-2024-25679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25679 · Security Note
• https://github.com/p-quic/pquic/issues/35 · Note
• https://twitter.com/CVEnew/status/1755885817350750473 · Twitter Post
• https://rfc-editor.org/rfc/rfc9001#name-discarding-unused-keys · Note
• https://t.me/cvenotify/70789 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755925018603630831 · Twitter Post