Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yODk0LXFjcWYtZzIzZ84AA2Ml

asyncua Improper Authentication vulnerability

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.

Note:

This issue is a result of missing checks for services that require an active session.

Permalink: https://github.com/advisories/GHSA-2894-qcqf-g23g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yODk0LXFjcWYtZzIzZ84AA2Ml
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00133
EPSS Percentile: 0.49527

Identifiers: GHSA-2894-qcqf-g23g, CVE-2023-26150
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-26150
• https://github.com/FreeOpcUa/opcua-asyncio/issues/1014
• https://github.com/FreeOpcUa/opcua-asyncio/pull/1015
• https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a
• https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513
• https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121
• https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96
• https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435
• https://github.com/pypa/advisory-database/tree/main/vulns/asyncua/PYSEC-2023-189.yaml
• https://github.com/advisories/GHSA-2894-qcqf-g23g

Repository: https://github.com/FreeOpcUa/opcua-asyncio
Blast Radius: 12.5

Affected Packages