[Bug 1235156] New: VUL-0: CVE-2023-49295: dnscrypt-proxy: github.com/quic-go/quic-go: memory exhaustion attack against QUIC's path validation mechanism
https://bugzilla.suse.com/show_bug.cgi?id=1235156 Bug ID: 1235156 Summary: VUL-0: CVE-2023-49295: dnscrypt-proxy: github.com/quic-go/quic-go: memory exhaustion attack against QUIC's path validation mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/390776/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2023-49295:6.5:(AV:N/AC:L/PR:L/UI:N/ S:U/C:N/I:N/A:H) CVSSv4:SUSE:CVE-2023-49295:6.0:(AV:N/AC:L/AT:P/PR:L/UI :N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) Severity: Normal Priority: P5 - None Component: Security Assignee: cunix@mail.de Reporter: andrea.mattiazzo@suse.com QA Contact: security-team@suse.de Blocks: 1234982 Target Milestone: --- Found By: --- Blocker: --- quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-49295 https://www.cve.org/CVERecord?id=CVE-2023-49295 https://github.com/quic-go/quic-go/commit/17fc98c2d81dbe685c19702dc694a9d606... https://github.com/quic-go/quic-go/commit/21609ddfeff93668c7625a85eb09f1541f... https://github.com/quic-go/quic-go/commit/3a9c18bcd27a01c551ac9bf8bd2b4bded7... https://github.com/quic-go/quic-go/commit/554d543b50b917369fb1394cc5396d9281... https://github.com/quic-go/quic-go/commit/6cc3d58935426191296171a6c0d1ee965e... https://github.com/quic-go/quic-go/commit/9aaefe19fc3dc8c8917cc87e6128bb56d9... https://github.com/quic-go/quic-go/commit/a0ffa757499913f7be69aa78f573a6aee3... https://github.com/quic-go/quic-go/commit/d7aa627ebde91cf799ada2a07443faa9b1... https://github.com/quic-go/quic-go/security/advisories/GHSA-ppxx-5m9h-6vxf https://bugzilla.redhat.com/show_bug.cgi?id=2257815 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235156 https://bugzilla.suse.com/show_bug.cgi?id=1235156#c1 --- Comment #1 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- The packages below are or contain embedded packages that are vulnerable to CVE-2023-49295: - openSUSE:Backports:SLE-15-SP5/dnscrypt-proxy contains embedded package: github.com/quic-go/quic-go (0.32.0) - openSUSE:Backports:SLE-15-SP5:Update/dnscrypt-proxy contains embedded package: github.com/quic-go/quic-go (0.32.0) - openSUSE:Backports:SLE-15-SP6/dnscrypt-proxy contains embedded package: github.com/quic-go/quic-go (0.37.4) - openSUSE:Backports:SLE-15-SP6:Update/dnscrypt-proxy contains embedded package: github.com/quic-go/quic-go (0.37.4) - openSUSE:Factory/dnscrypt-proxy contains embedded package: github.com/quic-go/quic-go (0.37.4) Please consider version bumping or patching the affected dependencies. The listed codestreams are affected. All other codestreams should not be affected, but feel free to double-check. This is a auto-generated message, please reach out to the reporter directly if you think this is incorrect. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235156 SMASH SMASH <smash_bz@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235156 https://bugzilla.suse.com/show_bug.cgi?id=1235156#c3 Andrea Mattiazzo <andrea.mattiazzo@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(maintenance@opens | |use.org) | --- Comment #3 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- (In reply to c unix from comment #2)
should be fixed for factory with version update: https://build.opensuse.org/request/show/1237072
@maintenance Is this needed for Leap and if yes, how to proceed?
No, this is needed only for the codestream mentioned above, since SLE-15-SP5 is now EOL, only openSUSE:Backports:SLE-15-SP6/dnscrypt-proxy is needed -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235156 https://bugzilla.suse.com/show_bug.cgi?id=1235156#c5 Andrea Mattiazzo <andrea.mattiazzo@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(andrea.mattiazzo@ |needinfo?(maintenance@opens |suse.com) |use.org) --- Comment #5 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- (In reply to c unix from comment #4)
Thanks for the info.
Can you please help me, by saying who should do this.
If it is me, what should i do - a submit request?
To which project/package should it be send to?
Directly to openSUSE:Backports:SLE-15-SP6/dnscrypt-proxy or to a Maintenance project ?
Thanks for the help!
I'm not fully sure about it, @maintenance could you help here? Thanks -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235156 https://bugzilla.suse.com/show_bug.cgi?id=1235156#c6 Marcus Meissner <meissner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(maintenance@opens | |use.org) | --- Comment #6 from Marcus Meissner <meissner@suse.com> --- openSUSE:Backports:SLE-15-SP6:Update as submit target -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235156 https://bugzilla.suse.com/show_bug.cgi?id=1235156#c8 --- Comment #8 from Marcus Meissner <meissner@suse.com> --- openSUSE-RU-2025:0019-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1222473,1235156 CVE References: JIRA References: Sources used: openSUSE Backports SLE-15-SP6 (src): dnscrypt-proxy-2.1.7-bp156.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com