Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oeHE0LW14MzctZnF2Z84AA0KX

s2n-quic potential denial of service vulnerability when receiving empty UDP packets

Impact

An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection.

No AWS services are affected by this issue and customers of AWS services do not need to take action. Applications using s2n-quic should upgrade their application to the most recent release of s2n-quic.

Impacted version: s2n-quic v1.22.0.

Patches

The patch is included in s2n-quic v1.23.0.

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Permalink: https://github.com/advisories/GHSA-hxq4-mx37-fqvg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oeHE0LW14MzctZnF2Z84AA0KX
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 10 months ago
Updated: 10 months ago

Identifiers: GHSA-hxq4-mx37-fqvg
References:

• https://github.com/aws/s2n-quic/security/advisories/GHSA-hxq4-mx37-fqvg
• https://github.com/aws/s2n-quic/commit/4b1d417e9de7eafaf5350553c5fcb9264dfa32f5
• https://github.com/aws/s2n-quic/releases/tag/v1.23.0
• https://github.com/advisories/GHSA-hxq4-mx37-fqvg

Repository: https://github.com/aws/s2n-quic
Blast Radius: 0.0

Affected Packages