CVE-2023-39322: Memory exhaustion in QUIC connection handling in crypto/tls
First published: Wed Sep 06 2023(Updated: )
Golang Go is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw when reading post-handshake messages. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause unbounded memory growth, and results in a denial of service condition.
Credit: security@golang.org security@golang.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golang Go | >=1.21.0<1.21.1 | |
| IBM Planning Analytics on Cloud Pak for Data | <=4.0 | |
| redhat/golang | <1.20.8 | 1.20.8 |
| redhat/golang | <1.21.1 | 1.21.1 |
Remedy
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://go.dev/cl/523039
- https://go.dev/issue/62266
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
- https://pkg.go.dev/vuln/GO-2023-2045
- https://security.netapp.com/advisory/ntap-20231020-0004/
- https://security.gentoo.org/glsa/202311-09
- https://exchange.xforce.ibmcloud.com/vulnerabilities/265863
- https://www.ibm.com/support/pages/node/7082784 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238811
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2238812
- https://access.redhat.com/errata/RHSA-2023:5974
- https://access.redhat.com/errata/RHSA-2023:6031
- https://access.redhat.com/errata/RHSA-2023:6085
- https://access.redhat.com/errata/RHSA-2023:6115
- https://access.redhat.com/errata/RHSA-2023:6119
- https://access.redhat.com/errata/RHSA-2023:6122
- https://access.redhat.com/errata/RHSA-2023:5947
- https://access.redhat.com/errata/RHSA-2023:6145
- https://access.redhat.com/errata/RHSA-2023:6148
- https://access.redhat.com/errata/RHSA-2023:6161
- https://access.redhat.com/errata/RHSA-2023:6200
- https://access.redhat.com/errata/RHSA-2023:6202
- https://access.redhat.com/errata/RHSA-2023:5009
- https://access.redhat.com/errata/RHSA-2023:6154
- https://access.redhat.com/errata/RHSA-2023:6840
- https://access.redhat.com/errata/RHSA-2023:7517
- https://access.redhat.com/errata/RHSA-2023:7762
- https://access.redhat.com/errata/RHSA-2023:7764
- https://access.redhat.com/errata/RHSA-2023:7765
- https://access.redhat.com/errata/RHSA-2023:7763
- https://access.redhat.com/errata/RHSA-2023:7766
- https://access.redhat.com/errata/RHSA-2024:0121
- https://access.redhat.com/errata/RHSA-2024:1901
- https://bugzilla.redhat.com/show_bug.cgi?id=2237778
Frequently Asked Questions
What is CVE-2023-39322?
CVE-2023-39322 is a vulnerability that allows a malicious QUIC connection to cause unbounded memory growth by not setting an upper bound on the amount of data buffered when reading post-handshake messages.
How does CVE-2023-39322 affect Golang Go?
CVE-2023-39322 affects Golang Go versions 1.21.0 up to but not including 1.21.1.
What is the severity of CVE-2023-39322?
CVE-2023-39322 has a severity rating of 7.5 (high).
How can CVE-2023-39322 be fixed?
CVE-2023-39322 can be fixed by updating Golang Go to version 1.21.1 or higher.
What is the CWE of CVE-2023-39322?
CVE-2023-39322 has CWE (Common Weakness Enumeration) vulnerabilities 770 and 400.
- collector/nvd-index
- collector/mitre-cve
- collector/nvd-api
- collector/ibm-support
- agent/type
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/softwarecombine
- agent/references
- agent/severity
- agent/remedy
- agent/title
- agent/description
- agent/event
- agent/tags
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-39322
- agent/software-canonical-lookup
- vendor/golang
- canonical/golang go
- version/golang go/1.21.0
- vendor/ibm
- canonical/ibm planning analytics on cloud pak for data
- version/ibm planning analytics on cloud pak for data/4.0
- package-manager/redhat