Headline
GHSA-p72g-cgh9-ghjg: Failing DTLS handshakes may cause throttling to block processing of records
Impact
Failing handshakes didn’t cleanup counters for throttling. In consequence the threshold may get reached and will not be released again. The results in permanently dropping records. The issues was reported for certificate based handshakes, but it can’t be excluded, that this happens also for PSK based handshakes. It generally affects client and server as well.
Patches
main: commit 726bac57659410da463dcf404b3e79a7312ac0b9 2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f
Users are requested to update to 3.7.0. If Californium 2 support is required, users are requested to update to 2.7.4.
Workarounds
none.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2022-39368
Failing DTLS handshakes may cause throttling to block processing of records
High severity GitHub Reviewed Published Nov 9, 2022 in eclipse-californium/californium • Updated Nov 9, 2022
Vulnerability details Dependabot alerts 0
Package
maven org.eclipse.californium:scandium (Maven)
Affected versions
>= 3.0.0, < 3.7.0
>= 2.7.0, < 2.7.4
Patched versions
3.7.0
2.7.4
Description
Impact
Failing handshakes didn’t cleanup counters for throttling. In consequence the threshold may get reached and will not be released again. The results in permanently dropping records. The issues was reported for certificate based handshakes, but it can’t be excluded, that this happens also for PSK based handshakes. It generally affects client and server as well.
Patches
main: commit 726bac57659410da463dcf404b3e79a7312ac0b9
2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f
Users are requested to update to 3.7.0. If Californium 2 support is required, users are requested to update to 2.7.4.
Workarounds
none.
References
- GHSA-p72g-cgh9-ghjg
- eclipse-californium/californium#2065
- eclipse-californium/californium@5648a0c
- eclipse-californium/californium@726bac5
- https://cwe.mitre.org/data/definitions/452.html
boaks published the maintainer security advisory
Nov 9, 2022
Severity
High
Weaknesses
No CWEs
CVE ID
CVE-2022-39368
GHSA ID
GHSA-p72g-cgh9-ghjg
Source code
eclipse-californium/californium
Checking history
See something to contribute? Suggest improvements for this vulnerability.
Related news
Red Hat Integration Camel K 1.10.1 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Important.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-4244: No description is available for this CVE. * CVE-2022-4245: No description is available for this CVE. * CVE-2022-39368: A flaw was found in the Eclipse Californium Scandium package. This issue occurs when failing handshakes don't clean up counters for throttling, causing the threshold to be reached without being released again, resulting in a denial of service. An attacker could submit a high quantity of server requests, leaving the serv...
Red Hat Security Advisory 2023-2100-01 - This release of Camel for Spring Boot 3.20.1 serves as a replacement for Camel for Spring Boot 3.18.3 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. The purpose of this text-only errata is to inform you about the security issues fixed. Issues addressed include bypass, code execution, cross site scripting, denial of service, man-in-the-middle, memory exhaustion, resource exhaustion, and traversal vulnerabilities.
Red Hat Integration Camel for Spring Boot 3.20.1 release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-37533: A flaw was found in Apache Commons Net's FTP, where the client trusts the host from PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This issue could lead to leakage of information about service...
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached without being released again. This results in permanently dropping records. The issue was reported for certificate based handshakes, but may also affect PSK based handshakes. It generally affects client and server as well. This issue is patched in version 3.7.0 and 2.7.4. There are no known workarounds. main: commit 726bac57659410da463dcf404b3e79a7312ac0b9 2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f