PT-2022-17596 · Opcua · Opcua

Sharon Brizinov + 2 · Published 2022-08-24 · Updated 2022-08-26 · CVE-2022-25903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions opcua versions 0.0.0 through 0.11.0

Description The issue allows for Denial of Service (DoS) via the ExtensionObjects and Variants objects. This occurs because the package allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.

Recommendations For versions 0.0.0 through 0.11.0, consider disabling the use of ExtensionObjects and Variants objects until a patch is available to prevent unlimited nesting levels and potential stack overflows. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-25903

GHSA-HGXQ-HCRM-C5PM

Affected Products

Opcua

References · 9

• https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd · Patch
• https://osv.dev/vulnerability/CVE-2022-25903 · Vendor Advisory
• https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25903 · Security Note
• https://osv.dev/vulnerability/GHSA-hgxq-hcrm-c5pm · Vendor Advisory
• https://github.com/locka99/opcua/pull/216 · Note
• https://github.com/locka99/opcua · Note
• https://t.me/cvenotify/35193 · Telegram Post
• https://t.me/cibsecurity/48628 · Telegram Post