Headline
GHSA-cx94-mrg9-rq4j: Buffer for inbound DTLS fragments has no limit
Impact
A buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage.
Patches
Upgrade to Pion DTLS v2.1.4
Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.4
References
Thank you to Juho Nurminen and the Mattermost team for discovering and reporting this.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Pion DTLS
- Email us at [email protected]
Buffer for inbound DTLS fragments has no limit
Moderate severity GitHub Reviewed Published May 24, 2022 in pion/dtls • Updated May 24, 2022
Package
gomod github.com/pion/dtls (Go )
Affected versions
< 2.1.4
Patched versions
2.1.4
Description
Impact
A buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage.
Patches
Upgrade to Pion DTLS v2.1.4
Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.4
References
Thank you to Juho Nurminen and the Mattermost team for discovering and reporting this.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Pion DTLS
- Email us at [email protected]
References
- GHSA-cx94-mrg9-rq4j
- https://nvd.nist.gov/vuln/detail/CVE-2022-29189
- pion/dtls@a6397ff
- https://github.com/pion/dtls/releases/tag/v2.1.4
Sean-Der published the maintainer security advisory
May 10, 2022
Severity
Moderate
5.3
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-120
CVE ID
CVE-2022-29189
GHSA ID
GHSA-cx94-mrg9-rq4j
Source code
github.com/pion/dtls
Improvements are not currently accepted on this advisory because it uses an unsupported versioning operator. Read more and discuss here.
Related news
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.