CVE-2024-45311
`Endpoint::retry()` calls can lead to panicking
Description
In 0.11.0, we overhauled the server-side `Endpoint` implementation to enable more careful handling of incoming connection attempts. However, some of the code paths that cleaned up state after connection attempts were processed confused the initial destination connection ID with the destination connection ID of a substantial package. This resulted in the internal `Endpoint` state becoming inconsistent, which could then lead to a panic. https://github.com/quinn-rs/quinn/commit/e01609ccd8738bd438d86fa7185a0f85598cb58f Thanks to [@finbear](https://github.com/finnbear) for reporting and investingating, and to [@BiagoFesta](https://github.com/BiagoFesta) for coordinating.
How to fix CVE-2024-45311
To remediate CVE-2024-45311, upgrade the affected package to a fixed version below.
- —upgrade to 0.11.7 or later
- —upgrade to 0.11.7 or later
Is CVE-2024-45311 being exploited?
Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 0.11.0, < 0.11.7
- >= 0.11.0, < 0.11.7
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |