GHSA-hxq4-mx37-fqvg: s2n-quic potential denial of service vulnerability when receiving empty UDP packets

June 30, 2023

An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection.

No AWS services are affected by this issue and customers of AWS services do not need to take action. Applications using s2n-quic should upgrade their application to the most recent release of s2n-quic.

Impacted version: s2n-quic v1.22.0.

References

github.com/advisories/GHSA-hxq4-mx37-fqvg
github.com/aws/s2n-quic
github.com/aws/s2n-quic/commit/4b1d417e9de7eafaf5350553c5fcb9264dfa32f5
github.com/aws/s2n-quic/releases/tag/v1.23.0
github.com/aws/s2n-quic/security/advisories/GHSA-hxq4-mx37-fqvg

Code Behaviors & Features

Detect and mitigate GHSA-hxq4-mx37-fqvg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →