Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jbThmLWg2ajMtcDI1Y84AArBD

Pion DTLS Header reconstruction method can be thrown into an infinite loop

Impact

An attacker can send packets that will send Pion DTLS into an infinite loop when processing.

Patches

Upgrade to Pion DTLS v2.1.4

Workarounds

No workarounds available, upgrade to Pion DTLS v2.1.4

References

Thank you to Juho Nurminen and the Mattermost team for discovering and reporting this.

For more information

If you have any questions or comments about this advisory:

Permalink: https://github.com/advisories/GHSA-cm8f-h6j3-p25c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jbThmLWg2ajMtcDI1Y84AArBD
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00167
EPSS Percentile: 0.53906

Identifiers: GHSA-cm8f-h6j3-p25c, CVE-2022-29190
References: Repository: https://github.com/pion/dtls
Blast Radius: 22.6

Affected Packages

go:github.com/pion/dtls/v2
Dependent packages: 966
Dependent repositories: 1,038
Downloads:
Affected Version Ranges: < 2.1.4
Fixed in: 2.1.4
All affected versions: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.1.0, 2.1.1, 2.1.2, 2.1.3
All unaffected versions: 2.1.4, 2.1.5, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.2.12
go:github.com/pion/dtls
Dependent packages: 63
Dependent repositories: 59
Downloads:
Affected Version Ranges: < 2.1.4
Fixed in: 2.1.4
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4
All unaffected versions: