Skip to content
OpenAdvisories
High MSRC-CVE-2023-38171 1 CVE

Microsoft QUIC Denial of Service Vulnerability

Published Oct 10, 2023 · Updated Dec 10, 2024 · Revision 3

Vendor: Microsoft

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

Where can I find more information?
Please see the GitHub Advisory relating to this vulnerability here: https://github.com/microsoft/msquic/security/advisories/GHSA-xh5m-8qqp-c5x7#event-111621

Security updates
17.2.21 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
17.4.13 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
10.0.20348.2031 — https://support.microsoft.com/help/5031364
10.0.22000.2538 — https://support.microsoft.com/help/5031358
10.0.22621.2428 — https://support.microsoft.com/help/5031354
7.0.13 — https://support.microsoft.com/help/5032875
7.3.9 — https://github.com/PowerShell/Announcements/issues/53

Vulnerabilities 1

Revision history

  1. #3

    To comprehensively address CVE-2023-38171, Microsoft released security updates on October 24, 2023 for all affected versions of .NET and Microsoft Visual Studio. Microsoft recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  2. #2

    Revised the Security Updates table to include PowerShell 7.3 because this version of PowerShell 7 is affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/53](https://github.com/PowerShell/Announcements/issues/53) for more information.

  3. #1

    Information published.

References