CVE-2022-25304

🗓️ 23 Aug 2022 05:05:11Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 74 Views

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk

Reporter	Title	Published	Views	Family All 21
ATTACKERKB	CVE-2022-25304	23 Aug 202205:01	–	attackerkb
Circl	CVE-2022-25304	23 Aug 202212:26	–	circl
CNNVD	python-opcua 安全漏洞	23 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-25304 Denial of Service (DoS)	23 Aug 202205:05	–	cvelist
Debian CVE	CVE-2022-25304	23 Aug 202205:05	–	debiancve
EUVD	EUVD-2022-6584	3 Oct 202520:07	–	euvd
Github Security Blog	Uncontrolled Resource Consumption in asyncua and opcua	24 Aug 202200:00	–	github
NVD	CVE-2022-25304	23 Aug 202205:15	–	nvd
OSV	DEBIAN-CVE-2022-25304	23 Aug 202205:15	–	osv
OSV	GHSA-MFPJ-3QHM-976M Uncontrolled Resource Consumption in asyncua and opcua	24 Aug 202200:00	–	osv

NVD

Node

asyncua_project asyncuapython

opcua_project opcuapython

[
  {
    "product": "opcua",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "asyncua",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
security	www.security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730
github	www.github.com/FreeOpcUa/python-opcua/issues/1466
security	www.security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-2988731

21 Nov 2024 06:51Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.00531

CWE-770