GHSA-w5f4-fx9m-m4q7: Nuget/Microsoft.Native.Quic.MsQuic.OpenSSL vulnerability
Summary
Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic.
Details
Only MsQuic with the OpenSSL and QuicTLS TLS backends is affected (the Schannel backend is not affected).
Patches
2.6.1, 2.5.11, and 2.4.20
Impact
An on-path attacker could spoof a server identity by using a certificate that doesn't match the intended target server hostname.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.OpenSSLto a version that resolves this vulnerability.Fixed in 2.6.1 - Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.OpenSSLto a version that resolves this vulnerability.Fixed in 2.5.11 - Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.OpenSSLto a version that resolves this vulnerability.Fixed in 2.4.20 - Upgrade
Upgrade
MsQuic with OpenSSL or QuicTLS TLS backendto a version that resolves this vulnerability.Fixed in 2.6.1 - Upgrade
Upgrade
MsQuic with OpenSSL or QuicTLS TLS backendto a version that resolves this vulnerability.Fixed in 2.5.11 - Upgrade
Upgrade
MsQuic with OpenSSL or QuicTLS TLS backendto a version that resolves this vulnerability.Fixed in 2.4.20
Event History
Frequently Asked Questions
Which deployments are affected?
Only MsQuic deployments using the OpenSSL or QuicTLS TLS backends are affected. Deployments using the Schannel backend are not affected.
What does an attacker need to exploit this issue?
The attacker must be on the network path between the client and server. They could then present a certificate that does not match the intended server hostname and spoof the server's identity.
Which releases contain fixes?
Fixed releases are 2.6.1, 2.5.11, and 2.4.20.