Advisoriesby IbisPotential denial of service when receiving empty UDP packets
Impact
An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection.
No AWS services are affected by this issue and customers of AWS services do not need to take action. Applications using s2n-quic should upgrade their application to the most recent release of s2n-quic.
Impacted version: s2n-quic v1.22.0.
Patches
The patch is included in s2n-quic [v1.23.0](https://github.com/aws/s2n-quic/releases/tag/v1.23.0).
If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| s2n-quic crates.io | < v1.23.0 | v1.23.0 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More AWS advisories
All AWS
Potential URI resolution path traversal in the AWS SDK for PHPCVE-2023-51651fixed in 3.288.1Potential denial of service via crafted stream framesGHSA-475v-pq2g-fp9gfixed in v1.31.0s2n-tls could negotiate signature algorithms not allowed by policyGHSA-97r4-p6c4-5gv3fixed in 1.3.54Potential denial of service after connection migrationGHSA-rfhg-rjfp-9q8qfixed in v1.25.0EKS overly permissive trust policiesCVE-2023-35165fixed in 2.80.0 +1Issue with parsing Certificate Common Name (CN) in s2n-tlsGHSA-h5p4-28rh-q272fixed in v1.3.35