CVE-2023-39322
Published: 8 September 2023
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
Notes
| Author | Note |
|---|---|
| mdeslaur | Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. |
| sbeattie | only affects golang-1.21 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
golang Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Not vulnerable
(golang 1.21 only)
|
|
| upstream |
Released
(1.21.1)
|
|
| xenial |
Does not exist
|
|
|
golang-1.10 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(golang 1.21 only)
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Not vulnerable
(golang 1.21 only)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(golang 1.21 only)
|
|
|
golang-1.13 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(golang 1.21 only)
|
| focal |
Not vulnerable
(golang 1.21 only)
|
|
| jammy |
Not vulnerable
(golang 1.21 only)
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(golang 1.21 only)
|
|
|
golang-1.14 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Not vulnerable
(golang 1.21 only)
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.16 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(golang 1.21 only)
|
| focal |
Not vulnerable
(golang 1.21 only)
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.17 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Not vulnerable
(golang 1.21 only)
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.18 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(golang 1.21 only)
|
| focal |
Not vulnerable
(golang 1.21 only)
|
|
| jammy |
Not vulnerable
(golang 1.21 only)
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(golang 1.21 only)
|
|
|
golang-1.19 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Not vulnerable
(golang 1.21 only)
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.20 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Not vulnerable
(golang 1.21 only)
|
|
| jammy |
Not vulnerable
(golang 1.21 only)
|
|
| lunar |
Not vulnerable
(golang 1.21 only)
|
|
| mantic |
Not vulnerable
(golang 1.21 only)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.21 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Not vulnerable
(1.21.1-1~ubuntu20.04.1)
|
|
| jammy |
Not vulnerable
(1.21.1-1~ubuntu22.04.1)
|
|
| lunar |
Not vulnerable
(1.21.1-1~ubuntu23.04.1)
|
|
| mantic |
Not vulnerable
(1.21.1-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Not vulnerable
(golang 1.21 only)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(golang 1.21 only)
|
|
|
golang-1.8 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(golang 1.21 only)
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
golang-1.9 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(golang 1.21 only)
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://go.dev/issue/62266
- https://github.com/golang/go/commit/91a4e74b98179f63a27dbff1ad68ddd0ed64363a (go1.21.1)
- https://groups.google.com/g/golang-announce/c/Fm51GRLNRvM
- https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
- https://go.dev/cl/523039
- https://pkg.go.dev/vuln/GO-2023-2045
- https://www.cve.org/CVERecord?id=CVE-2023-39322
- NVD
- Launchpad
- Debian