CVE-2023-39321: Panic when processing post-handshake message on QUIC connections in crypto/tls
First published: Wed Sep 06 2023(Updated: )
Golang Go is vulnerable to a denial of service, caused by a flaw when processing partial post-handshake message in QUICConn.HandleData in the crypto/tls package. By sending a specially crafted post-handshake message for a QUIC connection, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Credit: security@golang.org security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golang Go | >=1.21.0<1.21.1 | |
| IBM Planning Analytics on Cloud Pak for Data | <=4.0 | |
| redhat/golang | <1.20.8 | 1.20.8 |
| redhat/golang | <1.21.1 | 1.21.1 |
Remedy
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://go.dev/cl/523039
- https://go.dev/issue/62266
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
- https://pkg.go.dev/vuln/GO-2023-2044
- https://security.netapp.com/advisory/ntap-20231020-0004/
- https://security.gentoo.org/glsa/202311-09
- https://exchange.xforce.ibmcloud.com/vulnerabilities/265858
- https://www.ibm.com/support/pages/node/7082784 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238808
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238809
- https://access.redhat.com/errata/RHSA-2023:5974
- https://access.redhat.com/errata/RHSA-2023:6031
- https://access.redhat.com/errata/RHSA-2023:6085
- https://access.redhat.com/errata/RHSA-2023:6115
- https://access.redhat.com/errata/RHSA-2023:6119
- https://access.redhat.com/errata/RHSA-2023:6122
- https://access.redhat.com/errata/RHSA-2023:5947
- https://access.redhat.com/errata/RHSA-2023:6145
- https://access.redhat.com/errata/RHSA-2023:6148
- https://access.redhat.com/errata/RHSA-2023:6161
- https://access.redhat.com/errata/RHSA-2023:6200
- https://access.redhat.com/errata/RHSA-2023:6202
- https://access.redhat.com/errata/RHSA-2023:5009
- https://access.redhat.com/errata/RHSA-2023:6154
- https://access.redhat.com/errata/RHSA-2023:6840
- https://access.redhat.com/errata/RHSA-2023:7517
- https://access.redhat.com/errata/RHSA-2023:7762
- https://access.redhat.com/errata/RHSA-2023:7764
- https://access.redhat.com/errata/RHSA-2023:7766
- https://access.redhat.com/errata/RHSA-2023:7763
- https://access.redhat.com/errata/RHSA-2023:7765
- https://access.redhat.com/errata/RHSA-2024:0121
- https://access.redhat.com/errata/RHSA-2024:1901
- https://bugzilla.redhat.com/show_bug.cgi?id=2237777
Frequently Asked Questions
What is CVE-2023-39321?
CVE-2023-39321 is a vulnerability that causes a panic when processing an incomplete post-handshake message for a QUIC connection.
What is the severity of CVE-2023-39321?
The severity of CVE-2023-39321 is high with a CVSS score of 7.5.
How does CVE-2023-39321 affect the software?
CVE-2023-39321 affects Golang Go version 1.21.0 to 1.21.1.
How can I fix CVE-2023-39321?
To fix CVE-2023-39321, update Golang Go to a version higher than 1.21.1.
Where can I find more information about CVE-2023-39321?
You can refer to the following references for more information: [1] https://go.dev/cl/523039 [2] https://go.dev/issue/62266 [3] https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
- collector/nvd-index
- collector/mitre-cve
- collector/nvd-api
- collector/ibm-support
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- agent/severity
- agent/remedy
- agent/title
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-39321
- agent/software-canonical-lookup
- vendor/golang
- canonical/golang go
- version/golang go/1.21.0
- vendor/ibm
- canonical/ibm planning analytics on cloud pak for data
- version/ibm planning analytics on cloud pak for data/4.0
- package-manager/redhat