Trust Boundary Violation (TunnelVision) Affecting quincy package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-QUINCY-8553740
- published29 Dec 2024
- disclosed27 Dec 2024
- creditLizzie Moratti,Dani Cronce
Introduced: 27 Dec 2024
New CVE NOT AVAILABLE CWE-501 (opens in a new tab)How to fix?
There is no fixed version for quincy.
Overview
quincy is a VPN client and server implementation using the QUIC protocol
Affected versions of this package are vulnerable to Trust Boundary Violation (TunnelVision) in the routing of VPN traffic, when DHCP option 121 is enabled. An attacker on an untrusted network can inject a malicious entry into the victim's routing table which will redirect traffic intended for the VPN to a physical interface handling DHCP.
Workaround
Methods for avoiding this technique (other than disabling option 121 entirely) depend on the platform on which the application is running. For more detailed recommendations see the TunnelVision publication.