qcp
Secure remote file copy utility which uses the QUIC protocol over UDP
Activity
- Latest release
- 5d ago
- Total releases
- 24
- Cadence
- ~26 days
- Last 12 months
- 7
Reach
- Downloads
- 11.5k
Details
- License
- unknown
- First release
- Oct 25, 2024
| Version | Released | |
|---|---|---|
0.9.1
patch
|
0.9.1
patch
Dependencies (66)
+ 58 more
Changelog
Compare changes
|
|
0.9.0
unknown
|
0.9.0
unknown
Dependencies (66)
+ 58 more
Changelog
Compare changes
|
|
0.8.3
unknown
|
0.8.3
unknown
Dependencies (67)
+ 59 more
Changelog
Compare changes
|
|
0.8.2
unknown
|
0.8.2
unknown
Dependencies (67)
+ 59 more
Changelog
Compare changes
|
|
0.8.1
unknown
|
0.8.1
unknown
Dependencies (67)
+ 59 more
Changelog
Compare changes
|
|
0.8.0
unknown
|
0.8.0
unknown
Dependencies (67)
+ 59 more
Changelog
Compare changes
|
|
0.7.0
unknown
|
0.7.0
unknown
Dependencies (64)
+ 56 more
Changelog
Compare changes
|
|
0.6.0
unknown
|
0.6.0
unknown
Dependencies (66)
+ 58 more
Changelog
Compare changes
|
|
0.5.2
unknown
|
0.5.2
unknown
Dependencies (64)
+ 56 more
Changelog
Compare changes
|
|
0.5.1
unknown
|
0.5.1
unknown
Dependencies (64)
+ 56 more
Changelog
Compare changes
|
|
0.5.0
unknown
|
0.5.0
unknown
Dependencies (64)
+ 56 more
Changelog
Compare changes
|
|
0.4.2
unknown
|
0.4.2
unknown
Dependencies (55)
+ 47 more
Changelog
Compare changes
|
|
0.4.1
unknown
|
0.4.1
unknown
Dependencies (55)
+ 47 more
Changelog
Compare changes
|
|
0.4.0
unknown
|
0.4.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.3.3
unknown
|
0.3.3
unknown
Dependencies (49)
+ 41 more
Changelog
Compare changes
|
|
0.3.2
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.3.2
unknown
Dependencies (49)
+ 41 more
Changelog
Compare changes
|
|
0.3.1
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.3.1
unknown
Dependencies (49)
+ 41 more
Changelog
Compare changes
|
|
0.3.0
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.3.0
unknown
Dependencies (47)
+ 39 more
Changelog
Compare changes
|
|
0.2.1
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.2.1
unknown
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
0.2.0
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.2.0
unknown
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
0.1.3
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.1.3
unknown
Dependencies (26)
+ 18 more
Changelog
Compare changes
|
|
0.1.2
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.1.2
unknown
Dependencies (26)
+ 18 more
Changelog
Compare changes
|
|
0.1.1
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.1.1
unknown
Dependencies (26)
+ 18 more
Changelog
Compare changes
|
|
0.1.0
unknown
1 CVE
GHSA-fmwf-c46w-r8qm
Mar 08, 2025
qcp has possible crash/DOS in some build configurations
Medium
Network
Low
None
None
Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affectedAll versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks.
What to do if you are affectedWe recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade carefully. Alternatively, it is possible to avoid upgrading by rebuilding qcp locally. The following alternative mitigations have been identified:
DetailThe upstream advisory describes a crash in the implementation of the QUIC protocol that can be induced by a specially-crafted packet, and which happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only happens when runtime overflow checking is enabled. Note that the upstream advisory describes the overflow check causing this issue as "unwanted". Their response, to remove the overflow check in one place, does not introduce any additional issue. ImpactDuring qcp file transfer sessions, it is possible for an attacker to send a specially-crafted packet that could trigger this issue.
The underlying issue may also affect particularly large file transfers. The maximum TLS packet size is 16KB, so 2**32 packets will transfer up to 68TB (including the protocol/retransmit overhead). Again, this is only the case if qcp was built with runtime overflow checks enabled. As of the time of writing, we are not aware of any reports of this issue being exploited. Additional notes
ReferencesUpstream advisories:
Fixed in
0.3.3
References Updated Mar 08, 2025 · Source: OSV.dev |
0.1.0
unknown
Dependencies (26)
+ 18 more
Changelog
|