Insufficient verification of data authenticity in quic-go - CVE-2024-53259

Vulnerability identifier: #VU101816

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-53259

CWE-ID: CWE-345

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient verification of data authenticity when processing ICMP packets. A remote attacker can inject an ICMP Packet Too Large packet in the communication between the target host and the application and perform a denial of service (DoS) attack.

quic-go
VolSync
Traefik
Submariner
Splunk Universal Forwarder
Splunk Enterprise

Install updates from vendor's website.

quic-go - update to 0.48.2
VolSync - addressed in versions 0.10.2, 0.11.1
Traefik - addressed in versions 2.11.15, 3.2.2
Splunk Universal Forwarder - addressed in versions 9.1.9, 9.2.6, 9.3.4, 9.4.2
Splunk Enterprise - addressed in versions 9.1.9, 9.2.6, 9.3.4, 9.4.2
Submariner - addressed in versions 0.18.5, 0.19.4

• https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50
• https://github.com/quic-go/quic-go/pull/4729
• https://github.com/quic-go/quic-go/releases/tag/v0.48.2
• https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr

• Denial of service in QUIC Go
• Traefik update for quic-go
• Multiple vulnerabilities in VolSync
• Multiple vulnerabilities in VolSync
• Multiple vulnerabilities in Submariner 0.19
• Multiple vulnerabilities in Submariner 0.18
• Splunk Universal Forwarder update for third-party components
• Splunk Enterprise update for third-party components