Vulnerability CVE-2023-39321: Information

Description

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-39321

Published: Sept. 8, 2023

Modified: Nov. 25, 2023

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
golang	sisyphus	1.21.1-alt1	1.22.4-alt1	ALT-PU-2023-5463-1	328866	Fixed
golang	sisyphus_riscv64	1.21.1-alt0.port	1.22.4-alt1	ALT-PU-2023-5614-1	-	Fixed
golang	p10	1.20.8-alt1	1.21.11-alt1	ALT-PU-2023-5464-2	328867	Fixed
golang	c10f1	1.20.8-alt1	1.21.10-alt1	ALT-PU-2023-5492-2	328868	Fixed
golang	c9f2	1.20.11-alt1	1.20.13-alt1	ALT-PU-2023-7055-2	333913	Fixed
golang	p11	1.21.1-alt1	1.22.4-alt1	ALT-PU-2023-5463-1	328866	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ	Release Notes
https://go.dev/cl/523039	Patch
https://pkg.go.dev/vuln/GO-2023-2044	Vendor Advisory
https://go.dev/issue/62266	Issue Tracking
https://security.netapp.com/advisory/ntap-20231020-0004/	Third Party Advisory
https://security.gentoo.org/glsa/202311-09

Affected configurations:
1. Configuration 1
  cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
  Start including
  1.21.0
  End excliding
  1.21.1

VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla

Version: v24.5.3