by Kastro
Paper/Archive/CVE-2024-22590

CVE-2024-22590

ptrd kwik — The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection.

EPSS 0.6%public exploitCVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 47.8.478 × 209.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
kwik745fd4e2d8d104b9cf1e8342d150ff8967c65892 – < 11862d54d72de63abd0b76ca6bb9df56e634212c11862d54d72de63abd0b76ca6bb9df56e634212cCISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refgist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556