PT-2022-24935 · Eclipse · Eclipse Californium

Highboaks · Published 2022-11-09 · Updated 2022-11-17 · CVE-2022-39368

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Californium versions prior to 3.7.0 Eclipse Californium versions prior to 2.7.4

Description Eclipse Californium, a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services, is vulnerable to a Denial of Service. Failing handshakes do not cleanup counters for throttling, causing the threshold to be reached without being released again, resulting in permanently dropping records. The issue affects both certificate-based and potentially PSK-based handshakes and impacts both client and server.

Recommendations For versions prior to 3.7.0, update to version 3.7.0. For versions prior to 2.7.4, update to version 2.7.4. As a temporary workaround, consider restricting the handshake process to prevent the threshold from being reached, until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

CWE-459

Related Identifiers

CVE-2022-39368

GHSA-P72G-CGH9-GHJG

Affected Products

Eclipse Californium

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39368.json · Exploit
• https://github.com/eclipse-californium/californium/security/advisories/GHSA-p72g-cgh9-ghjg · Patch
• https://github.com/eclipse-californium/californium/commit/726bac57659410da463dcf404b3e79a7312ac0b9 · Patch
• https://github.com/eclipse-californium/californium/commit/5648a0c27c2c2667c98419254557a14bac2b1f3f · Patch
• https://osv.dev/vulnerability/GHSA-p72g-cgh9-ghjg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39368 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39368 · Vendor Advisory
• https://github.com/eclipse-californium/californium · Note
• https://github.com/eclipse-californium/californium/issues/2065 · Note
• https://t.me/cibsecurity/52800 · Telegram Post
• https://t.me/cvenotify/37436 · Telegram Post
• https://cwe.mitre.org/data/definitions/452.html · Note