98 matches found
CVE-2022-29190
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
CVE-2022-29190
Pion DTLS (Go) before v2.1.4 is vulnerable to an infinite-loop processing bug that an attacker can trigger, potentially causing a denial of service (availability impact high). The issue is fixed in v2.1.4. Multiple advisories (Ubuntu USN-7966-1/2, OSS vulnerabilities, Nessus/OSV entries) corrobor...
CVE-2022-29190 Header reconstruction method can be thrown into an infinite loop in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
CVE-2022-29190 Header reconstruction method can be thrown into an infinite loop in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
CVE-2022-29190
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
CVE-2022-29190 Header reconstruction method can be thrown into an infinite loop in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
CVE-2022-29190: Loop with Unreachable Exit Condition
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
CVE-2022-29189: Buffer Copy without Checking Size of Input
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could explo...
GHSA-7GFG-6934-MQQ2 Improper Authenication in Pion DTLS
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
Improper Authenication in Pion DTLS
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
Pion DTLS Authorization Issues Vulnerability
Pion DTLS is a Go-based implementation of DTLS Packet Transport Layer Security Protocol. An authorization issue vulnerability exists in Pion DTLS versions prior to 1.5.2. A remote attacker can exploit this vulnerability to inject arbitrary unencrypted data after the handshake completes...
CVE-2019-20786
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
CVE-2019-20786
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
Design/Logic Flaw
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
CVE-2019-20786
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
CVE-2019-20786
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...
PT-2020-10759
Name of the Vulnerable Software and Affected Versions Pion DTLS versions prior to 1.5.2 Description The issue allows remote attackers to inject arbitrary unencrypted data after handshake completion due to a lack of check for application data with epoch 0 in the handleIncomingPacket function. This...
CVE-2019-20786: Improper Authentication
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...