CVE-2024-45311 (High) detected in iroh-quinn-proto-0.11.6.crate

[mend-bolt-for-github]

CVE-2024-45311 - High Severity Vulnerability

Vulnerable Library - iroh-quinn-proto-0.11.6.crate

State machine for the QUIC transport protocol

Library home page: https://static.crates.io/crates/iroh-quinn-proto/iroh-quinn-proto-0.11.6.crate

Path to dependency file: /Cargo.toml

Path to vulnerable library: /Cargo.toml

Dependency Hierarchy:

• oku-fs-0.1.0 (Root Library)
  • quic-rpc-0.12.1.crate
    • iroh-quinn-0.11.3.crate
      • ❌ iroh-quinn-proto-0.11.6.crate (Vulnerable Library)

Found in HEAD commit: 0210244c73d8447f5fea76a1f812bd534796c09a

Found in base branch: master

Vulnerability Details

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to accept(), retry(), refuse(), or ignore() an Incoming connection. However, calling retry() on an unvalidated connection exposes the server to a likely panic in the following situations: 1. Calling refuse or ignore on the resulting validated connection, if a duplicate initial packet is received. This issue can go undetected until a server's refuse()/ignore() code path is exercised, such as to stop a denial of service attack. 2. Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received. This issue can go undetected if clients are well-behaved. The former situation was observed in a real application, while the latter is only theoretical.

Publish Date: 2024-09-02

URL: CVE-2024-45311

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vr26-jcq5-fjj8

Release Date: 2024-09-02

Fix Resolution: quinn-proto - 0.11.7

---

Step up your Open Source Security Game with Mend here