Description
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
microsoft msquic
< 2.4.20affected>= 2.5.0, < 2.5.11affected>= 2.6.0, < 2.6.1affected
References
- https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7 ↗
- https://github.com/microsoft/msquic/pull/6274 ↗
- https://github.com/microsoft/msquic/pull/6275 ↗
- https://github.com/microsoft/msquic/pull/6276 ↗
- https://github.com/microsoft/msquic/pull/6277 ↗
- https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412 ↗
- https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91 ↗
- https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81 ↗
- https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83 ↗
- https://github.com/microsoft/msquic/releases/tag/v2.4.20 ↗
- https://github.com/microsoft/msquic/releases/tag/v2.5.11 ↗
- https://github.com/microsoft/msquic/releases/tag/v2.6.1 ↗