PT-2024-31600 · Quicly · Quicly

Quictester · Published 2024-10-11 · Updated 2024-11-12 · CVE-2024-45396

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Quicly versions up to commtit d720707

Description: Quicly is an IETF QUIC protocol implementation. It is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes the process using quicly.

Recommendations: For Quicly versions up to commtit d720707, update to a version that includes commit 2a95896104901589c495bc41460262e64ffcad5c to address the vulnerability. As a temporary workaround, consider implementing measures to prevent remote attackers from triggering assertion failures, such as restricting access to the quicly process or monitoring for suspicious activity.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2024-45396

GHSA-MP3C-H5GG-MM6P

Affected Products

Quicly

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45396.json · Exploit
• https://github.com/h2o/quicly/commit/2a95896104901589c495bc41460262e64ffcad5c · Patch
• https://github.com/h2o/quicly/security/advisories/GHSA-mp3c-h5gg-mm6p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45396 · Security Note
• https://t.me/cvenotify/101434 · Telegram Post
• https://twitter.com/cracbot/status/1846430936675778585 · Twitter Post
• https://t.me/cvedetector/7687 · Telegram Post
• https://twitter.com/cracbot/status/1846068598076592581 · Twitter Post