CVE-2024-22588: Kwik does not discard unused encryption keys

May 24, 2024

Kwik commit 745fd4e2 does not discard unused encryption keys.

References

gist.github.com/QUICTester/29a1851c2b2a406411f688735526fe2e
github.com/advisories/GHSA-w8cp-frxc-55pj
github.com/ptrd/kwik
github.com/ptrd/kwik/commit/040b0d1327bfb0a8e35c23c2bd612a4a39b721d4
github.com/ptrd/kwik/issues/31
nvd.nist.gov/vuln/detail/CVE-2024-22588
www.rfc-editor.org/rfc/rfc9001

Code Behaviors & Features

Detect and mitigate CVE-2024-22588 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →