CVE-2023-39321: Panic when processing post-handshake message on QUIC connections in crypto/tls
Golang Go is vulnerable to a denial of service, caused by a flaw when processing partial post-handshake message in QUICConn.HandleData in the crypto/tls package. By sending a specially crafted post-handshake message for a QUIC connection, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Other sources
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
— MITRE
Processing an incomplete post-handshake message for a QUIC connection caused a panic.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-39321?
CVE-2023-39321 is a vulnerability that causes a panic when processing an incomplete post-handshake message for a QUIC connection.
What is the severity of CVE-2023-39321?
The severity of CVE-2023-39321 is high with a CVSS score of 7.5.
How does CVE-2023-39321 affect the software?
CVE-2023-39321 affects Golang Go version 1.21.0 to 1.21.1.
How can I fix CVE-2023-39321?
To fix CVE-2023-39321, update Golang Go to a version higher than 1.21.1.
Where can I find more information about CVE-2023-39321?
You can refer to the following references for more information: [1] https://go.dev/cl/523039 [2] https://go.dev/issue/62266 [3] https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ