Description
Microsoft QUIC Denial of Service Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – < 17.2.21 | 17.2.21 |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 – < 17.4.13 | 17.4.13 |
| Microsoft | Microsoft Visual Studio 2022 version 17.6 | 17.6.0 – < 17.6.9 | 17.6.9 |
| Microsoft | Microsoft Visual Studio 2022 version 17.7 | 17.7.0 – < 17.7.6 | 17.7.6 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 – < 10.0.20348.2031 | 10.0.20348.2031 |
| Microsoft | Windows 11 version 21H2 | 10.0.0 – < 10.0.22000.2538 | 10.0.22000.2538 |
| Microsoft | Windows 11 version 22H2 | 10.0.22621.0 – < 10.0.22621.2428 | 10.0.22621.2428 |
| Microsoft | .NET 7.0 | 7.0.0 – < 7.0.13 | 7.0.13 |
| Microsoft | PowerShell 7.3 | 7.3.0 – < 7.3.9 | 7.3.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | dotnet7-build | 7.0.112-r0 | — |
| Alpine v3.19 | dotnet7-runtime | 7.0.12-r0 | — |
| Alpine v3.18 | dotnet7-build | 7.0.112-r0 | — |
| Alpine v3.18 | dotnet7-runtime | 7.0.12-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.Native.Quic.MsQuic.OpenSSL | < 2.2.3 | 2.2.3 | GHSA-xh5m-8qqp-c5x7 |
| NuGet | Microsoft.Native.Quic.MsQuic.Schannel | < 2.2.3 | 2.2.3 | GHSA-xh5m-8qqp-c5x7 |
Advisories 6
- MSRC-CVE-2023-38171 Microsoft QUIC Denial of Service Vulnerability Microsoft Security Response Center · Dec 10, 2024
- NCSC-2024-0246 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 11, 2024
- ICSA-24-165-04 Siemens ST7 ScadaConnect CISA ICS & IT advisories · Jun 11, 2024
- SSA-341067 SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1 Siemens ProductCERT · Jun 11, 2024
- WID-SEC-2023-2606 Microsoft Windows und Microsoft Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 28, 2023
- WID-SEC-2023-2611 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 7, 2023
References
- Microsoft QUIC Denial of Service Vulnerability vendor-advisory