Source: rust-quinn-proto Version: 0.10.2-1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for rust-quinn-proto. CVE-2023-42805[0]: | quinn-proto is a state machine for the QUIC transport protocol. | Prior to versions 0.9.5 and 0.10.5, receiving unknown QUIC frames in | a QUIC packet could result in a panic. The problem has been fixed in | 0.9.5 and 0.10.5 maintenance releases. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-42805 https://www.cve.org/CVERecord?id=CVE-2023-42805 [1] https://github.com/quinn-rs/quinn/security/advisories/GHSA-q8wc-j5m9-27w3 [2] https://github.com/quinn-rs/quinn/pull/1667 (main) [3] https://github.com/quinn-rs/quinn/pull/1668 (backport to 0.9.x) [4] https://github.com/quinn-rs/quinn/pull/1669 (backport to 0.10.x) Please adjust the affected versions in the BTS as needed. Regards, Salvatore
