CVE-2023-39321 — Uncontrolled Resource Consumption in Standard Library Crypto TLS

CWE-400 — Uncontrolled Resource ConsumptionCWE-805 — Buffer Access with Incorrect Length Value6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 82.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GO Standard Library Crypto TLSGolang GO
Timeline
PublishedSep 8

Description

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDgolang/go1.21.0 — 1.21.1
▶CVEListV5go_standard_library/crypto_tls1.21.0-0 — 1.21.1

Patches

Patch: go.dev ↗Patch: go.dev ↗

🔴Vulnerability Details

4
GHSA
GHSA-9v7r-x7cv-v437: Processing an incomplete post-handshake message for a QUIC connection can cause a panic↗2023-09-08
▶
CVEList
Panic when processing post-handshake message on QUIC connections in crypto/tls↗2023-09-08
▶
OSV
CVE-2023-39321: Processing an incomplete post-handshake message for a QUIC connection can cause a panic↗2023-09-08
▶
OSV
Panic when processing post-handshake message on QUIC connections in crypto/tls↗2023-09-07
▶

📋Vendor Advisories

1
Red Hat
golang: crypto/tls: panic when processing post-handshake message on QUIC connections↗2023-09-06
▶
CVE-2023-39321 — Uncontrolled Resource Consumption | cvebase