← Zuruck zu CVEs
CVE-2022-29189
MEDIUM5.3
Beschreibung
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
CVE Details
CVSS v3.1 Bewertung5.3
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht5/21/2022
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
pion:dtls
Schwachen (CWE)
CWE-120
Referenzen
https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de(security-advisories@github.com)
https://github.com/pion/dtls/releases/tag/v2.1.4(security-advisories@github.com)
https://github.com/pion/dtls/security/advisories/GHSA-cx94-mrg9-rq4j(security-advisories@github.com)
https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/pion/dtls/releases/tag/v2.1.4(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/pion/dtls/security/advisories/GHSA-cx94-mrg9-rq4j(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.