git: cb4b734b55c9 - main - security/vuxml: Register net/quiche vulnerabilities
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 29 Mar 2024 17:46:54 UTC
The branch main has been updated by fernape:
URL: https://cgit.FreeBSD.org/ports/commit/?id=cb4b734b55c9805e5c9263913d6697b3e5c30135
commit cb4b734b55c9805e5c9263913d6697b3e5c30135
Author: Ralf van der Enden <tremere@cainites.net>
AuthorDate: 2024-03-29 17:45:22 +0000
Commit: Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2024-03-29 17:45:22 +0000
security/vuxml: Register net/quiche vulnerabilities
PR: 277692
Reported by: Ralf van der Enden <tremere@cainites.net>
Approved by: junho.choi@gmail.com (maintainer)
---
security/vuxml/vuln/2024.xml | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
index ee4064fe2bc9..072ed72c79c0 100644
--- a/security/vuxml/vuln/2024.xml
+++ b/security/vuxml/vuln/2024.xml
@@ -175,6 +175,45 @@
</dates>
</vuln>
+ <vuln vid="34f98d06-eb56-11ee-8007-6805ca2fa271">
+ <topic>quiche -- Multiple Vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>quiche</name>
+ <range><lt>0.20.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Quiche Releases reports:</p>
+ <blockquote cite="https://github.com/cloudflare/quiche/releases/tag/0.20.1">
+ <p>This release includes 2 security fixes:</p>
+ <ul>
+ <li>
+ CVE-2024-1410: Unbounded storage of information related to
+ connection ID retirement, in quiche. Reported by Marten
+ Seeman (@marten-seeman)
+ </li>
+ <li>
+ CVE-2024-1765: Unlimited resource allocation by QUIC
+ CRYPTO frames flooding in quiche. Reported by Marten
+ Seeman (@marten-seeman)
+ </li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2024-1410</cvename>
+ <cvename>CVE-2024-1765</cvename>
+ <url>https://github.com/cloudflare/quiche/releases/tag/0.20.1</url>
+ </references>
+ <dates>
+ <discovery>2024-03-12</discovery>
+ <entry>2024-03-26</entry>
+ </dates>
+ </vuln>
+
<vuln vid="80815c47-e84f-11ee-8e76-a8a1599412c6">
<topic>chromium -- multiple security fixes</topic>
<affects>