7.5
CVE-2023-42805
- EPSS 0.76%
- Veröffentlicht 21.09.2023 17:15:23
- Zuletzt bearbeitet 21.11.2024 08:23:11
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Loginquinn-proto Denial of Service vulnerability
quinn-proto is a state machine for the QUIC transport protocol. Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in a QUIC packet could result in a panic. The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quinn Project ≫ Quinn SwPlatformrust Version < 0.9.5
Quinn Project ≫ Quinn SwPlatformrust Version >= 0.10.0 < 0.10.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.76% | 0.504 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| security-advisories@github.com | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
https://github.com/quinn-rs/quinn/pull/1667
https://github.com/quinn-rs/quinn/pull/1668
https://github.com/quinn-rs/quinn/pull/1669
https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3