PT-2022-17497 · Open62541 · Open62541

Sharon Brizinov + 2 · Published 2022-08-23 · Updated 2023-02-28 · CVE-2022-25761

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions open62541/open62541 versions 1.2.0 through 1.2.4 open62541/open62541 versions 1.3-rc1 through 1.3.0

Description The issue is related to a Denial of Service (DoS) due to a missing limitation on the number of received chunks per single session or in total for all concurrent sessions. An attacker can exploit this by sending an unlimited number of huge chunks without sending the Final closing chunk.

Recommendations For versions 1.2.0 through 1.2.4, update to version 1.2.5 or later. For versions 1.3-rc1 through 1.3.0, update to version 1.3.1 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-25761

Affected Products

Open62541

References · 10

• https://github.com/open62541/open62541/commit/b79db1ac78146fc06b0b8435773d3967de2d659c · Patch
• https://github.com/open62541/open62541/pull/5173 · Patch
• https://security.snyk.io/vuln/SNYK-UNMANAGED-OPEN62541OPEN62541-2988719 · Patch
• https://osv.dev/vulnerability/CVE-2022-25761 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JNUV4FDVDBQHCPMOOEVKLMQK5SLKPK2L · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25761 · Security Note
• https://github.com/open62541/open62541/releases/tag/v1.3.1 · Note
• https://github.com/open62541/open62541/releases/tag/v1.2.5 · Note
• https://t.me/cvenotify/43062 · Telegram Post
• https://t.me/cvenotify/35045 · Telegram Post