org.apache.camel.karaf:camel-coap (>=4.7.0 <=4.18.2), org.apache.camel.quarkus:camel-quarkus-coap (>=3.8.0 <=3.36.0) +32 more potentially affected by CVE-2022-39368 via org.eclipse.californium:scandium (>=3.0.0 <=3.6.0)

org.eclipse.californium:scandium MAVEN version =3.0.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.4.0, =4.4.0, =3.0.0, =3.0.0, =3.0.0, =3.12.0, =2.0.0, =2.0.0-M6, =2.0.0-M6, =2.0.0-M6, =2.0.0-M6, =2.0.0-M15 and more Source cves: CVE-2022-39368 Source advisory: OSV:GHSA-P72G-CGH9-GHJG...

CVE-2022-39368 Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records

Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached...

CVE-2022-39368

CVE-2022-39368 affects Eclipse Californium (Java CoAP) versions prior to 3.7.0 and 2.7.4. The root cause is that failing DTLS handshakes do not clean up throttling counters, allowing the threshold to be reached and never released, which can lead to a denial of service by permanently dropping reco...

CVE-2022-39368 Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records

Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached...