x/vulndb: potential Go vuln in github.com/quic-go/quic-go: CVE-2023-46239

[GoVulnBot]

CVE-2023-46239 references github.com/quic-go/quic-go, which may be a Go module.

Description: quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-46239
• JSON: https://github.com/CVEProject/cvelist/tree/3d71aea786336bc1b21ed628edadee5d3569a8c8/2023/46xxx/CVE-2023-46239.json
• advisory: https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h
• fix: https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617
• web: https://github.com/quic-go/quic-go/releases/tag/v0.37.3
• Imported by: https://pkg.go.dev/github.com/quic-go/quic-go?tab=importedby

Cross references: No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/quic-go/quic-go
      vulnerable_at: 0.40.0
      packages:
        - package: quic-go
cves:
    - CVE-2023-46239
references:
    - advisory: https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h
    - fix: https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617
    - web: https://github.com/quic-go/quic-go/releases/tag/v0.37.3

[neild]

Duplicate of #2160