PT-2022-4448 · Asyncua+2 · Asyncua+2

Sharon Brizinov + 2 · Published 2022-08-23 · Updated 2022-09-06 · CVE-2022-25304

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions opcua versions all asyncua versions all

Description The issue is related to an uncontrolled consumption of resources in the opcua and asyncua libraries. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is due to a missing limitation on the number of received chunks per single session or in total for all concurrent sessions. An attacker can exploit this by sending a large number of huge chunks without sending the final closing chunk.

Recommendations For opcua all versions, consider implementing a limitation on the number of received chunks per session to prevent exploitation. For asyncua all versions, consider implementing a limitation on the number of received chunks per session to prevent exploitation. As a temporary workaround, consider restricting the size of chunks that can be received by the library to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2022-05313

CVE-2022-25304

GHSA-MFPJ-3QHM-976M

Affected Products

Debian

Asyncua

Opcua

References · 16

• https://security-tracker.debian.org/tracker/CVE-2022-25304 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25304 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25304 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25304 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25304 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25304 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25304 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05313 · Security Note
• https://osv.dev/vulnerability/GHSA-mfpj-3qhm-976m · Vendor Advisory
• https://github.com/FreeOpcUa/python-opcua/issues/1466 · Note
• https://github.com/FreeOpcUa/opcua-asyncio · Note
• https://github.com/FreeOpcUa/opcua-asyncio/commit/01c7acf047887b62d979cd4373d370e72a4b9057 · Note
• https://security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730 · Note
• https://t.me/cibsecurity/48573 · Telegram Post
• https://t.me/cvenotify/35046 · Telegram Post