REDHAT-BUG-2403125: Medium severity Quic-go quic-go vulnerability
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKEDONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKEDONE frame, thereby correctly handling premature HANDSHAKEDONE frames.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
quic-goto a version that resolves this vulnerability.Fixed in 0.49.0 - Upgrade
Upgrade
quic-goto a version that resolves this vulnerability.Fixed in 0.54.1 - Upgrade
Upgrade
quic-goto a version that resolves this vulnerability.Fixed in 0.55.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2403125?
The severity of REDHAT-BUG-2403125 is considered critical as it allows a denial-of-service (DoS) attack.
How do I fix REDHAT-BUG-2403125?
To fix REDHAT-BUG-2403125, upgrade quic-go to version 0.49.0, 0.54.1, or 0.55.0 or later.
What are the affected versions of quic-go in REDHAT-BUG-2403125?
Affected versions of quic-go in REDHAT-BUG-2403125 are all versions prior to 0.49.0, 0.54.1, and 0.55.0.
What type of attack does REDHAT-BUG-2403125 enable?
REDHAT-BUG-2403125 enables a denial-of-service (DoS) attack, which can crash the client.
Is authentication required to exploit REDHAT-BUG-2403125?
No, exploitation of REDHAT-BUG-2403125 does not require any authentication.