Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oZ3hxLWhjcm0tYzVwbc4AAubl

opcua Vulnerable to Out-of-bounds Write

The package opcua from 0.0.0 until 0.11.0 is vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.

Permalink: https://github.com/advisories/GHSA-hgxq-hcrm-c5pm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oZ3hxLWhjcm0tYzVwbc4AAubl
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-hgxq-hcrm-c5pm, CVE-2022-25903
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-25903
• https://github.com/locka99/opcua/pull/216
• https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd
• https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750
• https://github.com/advisories/GHSA-hgxq-hcrm-c5pm

Repository: https://github.com/locka99/opcua
Blast Radius: 4.5

Affected Packages