Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The quicheconnectioniditernext and quicheconnretiredscidnext functions would return a pointer to a ConnectionId to the applications via function arguments, but the the owned ConnectionId would be dropped at the end of those functions' scope. Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag. quiche 0.29.2 is the earliest version containing the fix for this issue.
Recommended action: Upgrade to 0.29.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRECONNECTIONID frames. QUIC connections possess a set of connection identifiers (IDs); see Section 5.1 of RFC 9000. Once the QUIC handshake completes, a local endpoint is responsible for issuing and retiring Connection IDs that are used by the remote peer to populate the Destination Connection ID field in packets sent from remote to local. Each Connection ID has a sequence number to ensure synchronization between peers An unauthenticated remote attacker can exploit this vulnerability by first completing a handshake and then sending a specially-crafted set of frames that trigger a connection ID retirement in the victim. When the victim attempts to send a packet containing RETIRECONNECTIONID frames, Section 19.16 of RFC 9000 requires that the sequence number of the retired connection ID must not be the same as the sequence number of the connection ID used by the packet. In…
Recommended action: Upgrade to 0.24.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker. Patches Quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.
Recommended action: Upgrade to 0.20.1 or 0.19.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs); see RFC 9000 Section 5.1. Endpoints declare the number of active connection IDs they are willing to support using the activeconnectionidlimit transport parameter. The peer can create new IDs using a NEWCONNECTIONID frame but must stay within the active ID limit. This is done by retirement of old IDs, the endpoint sends NEWCONNECTIONID includes a value in the retirepriorto field, which elicits a RETIRECONNECTIONID frame as confirmation. An unauthenticated remote attacker can exploit the vulnerability by sending NEWCONNECTIONID frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that RETIRECONNECTIONID frames can only be sent at a slower rate than they are received, leading to storage of…
Recommended action: Upgrade to 0.20.1 or 0.19.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATHCHALLENGE frame responds by sending a PATHRESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATHCHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATHRESPONSE frames can only be sent at the slower rate than they are received, leading to storage of path validation data in an unbounded queue. Patches Quiche versions greater than 0.19.0 address this problem. References CVE-2023-6193 RFC 9000 Section 8.2
Recommended action: Upgrade to 0.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.