Description
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 go | | | 0.56.0 |
 debian 13 | | =1:0.25.0-1 || =1:0.33.0-1~exp1 || =1:0.36.0-1~exp1 || =1:0.41.0-1~exp1 || =1:0.42.0-1 || =1:0.42.0-1~exp1 || =1:0.42.0-2 || =1:0.42.0-3 || =1:0.42.0-4 || =1:0.43.0-1 || =1:0.43.0-2 || =1:0.45.0-1 || =1:0.46.0-1 || =1:0.47.0-1 || =1:0.50.0-1 || =1:0.52.0-1 || =1:0.52.0-1~bpo13+1 || =1:0.53.0-1 || =1:0.54.0-1 || =1:0.55.0-1 || =1:0.56.0-1 | - |
debian 14 | | =1:0.25.0-1 || =1:0.33.0-1~exp1 || =1:0.36.0-1~exp1 || =1:0.41.0-1~exp1 || =1:0.42.0-1 || =1:0.42.0-1~exp1 || =1:0.42.0-2 || =1:0.42.0-3 || =1:0.42.0-4 || =1:0.43.0-1 || =1:0.43.0-2 || =1:0.45.0-1 || =1:0.46.0-1 || =1:0.47.0-1 || =1:0.50.0-1 || =1:0.52.0-1 || =1:0.52.0-1~bpo13+1 || =1:0.53.0-1 || =1:0.54.0-1 || =1:0.55.0-1 || >=0 <1:0.56.0-1 | 1:0.56.0-1 |
debian 12 | | =1:0.10.0-1 || =1:0.12.0-1 || =1:0.13.0-1 || =1:0.14.0-1 || =1:0.16.0-1 || =1:0.17.0-1 || =1:0.18.0-1 || =1:0.19.0-1 || =1:0.21.0-1 || =1:0.22.0-1 || =1:0.23.0-1 || =1:0.24.0-1 || =1:0.24.0-2 || =1:0.25.0-1 || =1:0.25.0-1~bpo12+1 || =1:0.33.0-1~exp1 || =1:0.36.0-1~exp1 || =1:0.4.0-1 || =1:0.41.0-1~exp1 || =1:0.42.0-1 || =1:0.42.0-1~exp1 || =1:0.42.0-2 || =1:0.42.0-3 || =1:0.42.0-4 || =1:0.43.0-1 || =1:0.43.0-2 || =1:0.45.0-1 || =1:0.46.0-1 || =1:0.47.0-1 || =1:0.50.0-1 || =1:0.52.0-1 || =1:0.52.0-1~bpo13+1 || =1:0.53.0-1 || =1:0.54.0-1 || =1:0.55.0-1 || =1:0.56.0-1 | - |
 rpm rhel10 | | - | - |
rpm rhel8 | | - | - |
rpm rhel10 | | - | - |
rpm rhel9 | | - | - |
rpm rhel10 | | - | - |
rpm rhel9 | | - | - |
