PT-2022-4450 · Opcua · Opcua

Sharon Brizinov + 2 · Published 2022-08-23 · Updated 2022-08-25 · CVE-2022-25888

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions opcua versions 0.0.0 and later

Description The issue is related to a Denial of Service (DoS) due to a missing limitation on the number of received chunks per single session or in total for all concurrent sessions. An attacker can exploit this by sending an unlimited number of huge chunks without sending the Final closing chunk, leading to uncontrolled resource consumption. This can allow a remote attacker to cause a service disruption.

Recommendations For versions 0.0.0 and later, consider implementing a limitation on the number of received chunks per session or in total for all concurrent sessions to prevent uncontrolled resource consumption. As a temporary workaround, consider restricting the size of chunks that can be received or implementing rate limiting on incoming chunks to minimize the risk of exploitation.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2022-05315

CVE-2022-25888

GHSA-8MX2-GQX9-RM7F

Affected Products

Opcua

References · 9

• https://github.com/locka99/opcua/pull/216/commits/6fb683c5fec46c6dd347824491c4d93a229da695 · Patch
• https://github.com/locka99/opcua/pull/216 · Patch
• https://bdu.fstec.ru/vul/2022-05315 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25888 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25888 · Vendor Advisory
• https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988751 · Patch
• https://osv.dev/vulnerability/GHSA-8mx2-gqx9-rm7f · Vendor Advisory
• https://github.com/locka99/opcua · Note
• https://t.me/cvenotify/35044 · Telegram Post