Lucene search
GitHub Advisory DatabaseGHSA-XH5M-8QQP-C5X7HistoryOct 10, 2023 - 9:23 p.m.
Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel
2023-10-1021:23:27
CWE-400
CWE-476
GitHub Advisory Database
github.com
26
msquic
denial of service
vulnerability
microsoft.native.quic.msquic.schannel
patches
version negotiation packets
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.003
Percentile
68.8%
Impact
The MsQuic server application or process will crash, resulting in a denial of service.
Patches
The following patch was made:
- Donât Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343
Workarounds
Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.
Affected configurations
Node
microsoftnative.quic.msquic.opensslRange<2.2.3
ORmicrosoftnative.quic.msquic.schannelRange<2.2.3
| Vendor | Product | Version | CPE |
|---|---|---|---|
| microsoft | native.quic.msquic.openssl | * | cpe:2.3:a:microsoft:native.quic.msquic.openssl:*:*:*:*:*:*:*:* |
| microsoft | native.quic.msquic.schannel | * | cpe:2.3:a:microsoft:native.quic.msquic.schannel:*:*:*:*:*:*:*:* |
Related
redhatcve
redhatcve
CVE-2023-38171
2023-10-10 21:13:33
alpinelinux
alpinelinux
CVE-2023-38171
2023-10-10 18:15:18
osv
osv
BIT-dotnet-2023-38171
2024-03-06 10:52:42
CVE-2023-38171
2023-10-10 18:15:18
nvd
nvd
CVE-2023-38171
2023-10-10 18:15:18
veracode
veracode
Denial Of Service (DoS)
2023-10-12 06:20:52
cnvd
cnvd
Microsoft QUIC Denial of Service Vulnerability (CNVD-2023-92205)
2023-10-13 00:00:00
cvelist
cvelist
CVE-2023-38171 Microsoft QUIC Denial of Service Vulnerability
2023-10-10 17:07:23
mscve
mscve
Microsoft QUIC Denial of Service Vulnerability
2023-10-10 07:00:00
cve
cve
CVE-2023-38171
2023-10-10 18:15:18
prion
prion
Denial of service
2023-10-10 18:15:00
nessus
nessus
Security Updates for Microsoft Visual Studio Products (October 2023)
2023-10-13 00:00:00
Security Update for .NET Core SDK (October 2023)
2023-10-11 00:00:00
Security Update for Microsoft .NET 7 Core (October 2023)
2023-10-13 00:00:00
openvas
openvas
.NET Core Multiple DoS Vulnerabilities - Windows
2023-10-11 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB5031354)
2023-10-11 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB5031358)
2023-10-11 00:00:00
mskb
mskb
.NET 7.0 Update - October 10, 2023 (KB5031901)
2023-10-10 07:00:00
October 10, 2023âKB5031354 (OS Build 22621.2428)
2023-10-10 07:00:00
October 10, 2023âKB5031358 (OS Build 22000.2538)
2023-10-10 07:00:00
kaspersky
kaspersky
KLA61353 Multiple vulnerabilities in Microsoft Developer Tools
2023-10-10 00:00:00
KLA61358 Multiple vulnerabilities in Microsoft Windows
2023-10-10 00:00:00
ibm
ibm
ics
ics
Siemens ST7 ScadaConnect
2024-06-13 12:00:00
rapid7blog
rapid7blog
Patch Tuesday - October 2023
2023-10-10 20:34:57
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.003
Percentile
68.8%
Related for GHSA-XH5M-8QQP-C5X7