PT-2022-19441 · Pion Dtls+2 · Pion Dtls+2

Juho Nurminen · Published 2022-05-20 · Updated 2026-01-19 · CVE-2022-29189

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Pion DTLS versions prior to 2.1.4

Description The issue concerns a buffer used for inbound network traffic that had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage.

Recommendations For versions prior to 2.1.4, upgrade to Pion DTLS version 2.1.4 to resolve the issue. As a temporary workaround, consider restricting the amount of network traffic from remote users to minimize the risk of exploitation until a patch is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-29189

GHSA-CX94-MRG9-RQ4J

GO-2022-0461

USN-7966-1

USN-7966-2

Affected Products

Linuxmint

Pion Dtls

Ubuntu

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29189.json · Exploit
• https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29189 · Security Note
• https://osv.dev/vulnerability/USN-7966-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29189 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29189 · Security Note
• https://ubuntu.com/security/CVE-2022-29189 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7966-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29222 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cx94-mrg9-rq4j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29189 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-29189 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7966-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29189 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7966-2 · Vendor Advisory