Debian Package Tracker
Register | Log in
Subscribe

golang-github-lucas-clemente-quic-go

QUIC golang library

Choose email to subscribe with

general
  • source: golang-github-lucas-clemente-quic-go (main)
  • version: 0.50.1-2
  • maintainer: Debian Go Packaging Team (DMD)
  • uploaders: John Goerzen [DMD] – Alexandre Viau [DMD] – Roger Shimizu [DMD] – Aloïs Micard [DMD]
  • arch: all
  • std-ver: 4.6.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 0.19.3-1
  • old-bpo: 0.29.0-1~bpo11+2
  • stable: 0.29.0-1
  • stable-bpo: 0.46.0-2~bpo12+1
  • testing: 0.50.1-2
  • unstable: 0.50.1-2
versioned links
  • 0.19.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.29.0-1~bpo11+2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.29.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.46.0-2~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.50.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • golang-github-lucas-clemente-quic-go-dev
action needed
A new upstream version is available: 0.52.0 high
A new upstream version 0.52.0 is available, you should consider packaging it.
Created: 2025-04-24 Last update: 2025-05-30 14:02
debian/patches: 1 patch with invalid metadata, 3 patches to forward upstream high

Among the 5 debian patches available in version 0.50.1-2 of the package, we noticed the following issues:

  • 1 patch with invalid metadata that ought to be fixed.
  • 3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-04-26 08:31
1 bug tagged patch in the BTS normal
The BTS contains patches fixing 1 bug, consider including or untagging them.
Created: 2025-05-12 Last update: 2025-05-30 18:30
Fails to build during reproducibility testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2024-10-09 Last update: 2025-05-30 13:30
lintian reports 1 warning normal
Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.
Created: 2025-04-26 Last update: 2025-04-26 06:03
3 low-priority security issues in bookworm low

There are 3 open security issues in bookworm.

3 issues left for the package maintainer to handle:
  • CVE-2023-49295: (needs triaging) quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.
  • CVE-2024-22189: (needs triaging) quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.
  • CVE-2024-53259: (needs triaging) quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-01-12 Last update: 2025-05-06 06:30
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.6.2).
Created: 2024-04-07 Last update: 2025-04-26 01:00
news
[rss feed]
  • [2025-05-06] golang-github-lucas-clemente-quic-go 0.50.1-2 MIGRATED to testing (Debian testing watch)
  • [2025-04-25] Accepted golang-github-lucas-clemente-quic-go 0.50.1-2 (source) into unstable (John Goerzen)
  • [2025-04-05] golang-github-lucas-clemente-quic-go 0.50.1-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-31] Accepted golang-github-lucas-clemente-quic-go 0.50.1-1 (source) into unstable (Jérémy Lal)
  • [2025-03-23] golang-github-lucas-clemente-quic-go 0.50.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-18] Accepted golang-github-lucas-clemente-quic-go 0.50.0-1 (source) into unstable (Jérémy Lal)
  • [2024-09-08] Accepted golang-github-lucas-clemente-quic-go 0.46.0-2~bpo12+1 (source) into stable-backports (John Goerzen)
  • [2024-08-22] golang-github-lucas-clemente-quic-go 0.46.0-2 MIGRATED to testing (Debian testing watch)
  • [2024-08-14] Accepted golang-github-lucas-clemente-quic-go 0.46.0-2 (source) into unstable (Shengjing Zhu)
  • [2024-08-13] Accepted golang-github-lucas-clemente-quic-go 0.46.0-1 (source) into unstable (Shengjing Zhu)
  • [2024-05-19] golang-github-lucas-clemente-quic-go 0.38.2-2 MIGRATED to testing (Debian testing watch)
  • [2024-05-19] golang-github-lucas-clemente-quic-go 0.38.2-2 MIGRATED to testing (Debian testing watch)
  • [2024-05-14] Accepted golang-github-lucas-clemente-quic-go 0.38.2-2 (source) into unstable (Shengjing Zhu)
  • [2024-01-09] golang-github-lucas-clemente-quic-go 0.38.2-1 MIGRATED to testing (Debian testing watch)
  • [2024-01-04] Accepted golang-github-lucas-clemente-quic-go 0.38.2-1 (source) into unstable (Shengjing Zhu)
  • [2023-11-12] Accepted golang-github-lucas-clemente-quic-go 0.37.4-1~bpo12+1 (source all) into stable-backports (Debian FTP Masters) (signed by: John Goerzen)
  • [2023-08-21] golang-github-lucas-clemente-quic-go 0.37.4-1 MIGRATED to testing (Debian testing watch)
  • [2023-08-16] Accepted golang-github-lucas-clemente-quic-go 0.37.4-1 (source) into unstable (Shengjing Zhu)
  • [2023-07-27] Accepted golang-github-lucas-clemente-quic-go 0.37.0-1 (source) into experimental (Shengjing Zhu)
  • [2023-06-17] golang-github-lucas-clemente-quic-go 0.29.2-3 MIGRATED to testing (Debian testing watch)
  • [2023-06-11] Accepted golang-github-lucas-clemente-quic-go 0.29.2-3 (source) into unstable (Shengjing Zhu)
  • [2023-03-08] Accepted golang-github-lucas-clemente-quic-go 0.29.0-1~bpo11+2 (source all) into bullseye-backports (Nicholas D Steeves)
  • [2023-03-08] Accepted golang-github-lucas-clemente-quic-go 0.29.0-1~bpo11+1 (source) into bullseye-backports (Nicholas D Steeves)
  • [2023-01-16] Accepted golang-github-lucas-clemente-quic-go 0.29.2-2 (source) into experimental (Shengjing Zhu)
  • [2023-01-16] Accepted golang-github-lucas-clemente-quic-go 0.29.2-1 (source) into experimental (Shengjing Zhu)
  • [2022-09-12] golang-github-lucas-clemente-quic-go 0.29.0-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-12] golang-github-lucas-clemente-quic-go 0.29.0-1 MIGRATED to testing (Debian testing watch)
  • [2022-06-15] Accepted golang-github-lucas-clemente-quic-go 0.26.0-1~bpo11+1 (source all) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Nicholas D Steeves)
  • [2022-04-05] golang-github-lucas-clemente-quic-go 0.26.0-1 MIGRATED to testing (Debian testing watch)
  • [2022-04-01] Accepted golang-github-lucas-clemente-quic-go 0.26.0-1 (source) into unstable (Nilesh Patra)
  • 1
  • 2
bugs [bug history graph]
  • all: 3
  • RC: 0
  • I&N: 2
  • M&W: 1
  • F&P: 0
  • patch: 1
links
  • homepage
  • lintian (0, 1)
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 0.50.1-2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing