PT-2023-20530 · Asyncua · Asyncua

Tran Van Arthur · Published 2023-10-02 · Updated 2023-10-04 · CVE-2023-26151

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions asyncua versions prior to 0.9.96

Description The issue allows an attacker to send a malformed packet, causing the server to enter an infinite loop and consume excessive memory, resulting in a Denial of Service (DoS).

Recommendations For versions prior to 0.9.96, update to version 0.9.96 or later to resolve the issue. As a temporary workaround, consider implementing packet validation to prevent malformed packets from being processed by the server. Restrict access to the server to minimize the risk of exploitation until the update is applied.

Exploit

Fix

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

CVE-2023-26151

GHSA-GFVQ-MXW3-MFQ3

PYSEC-2023-190

Affected Products

Asyncua

References · 17

• 🔥 https://github.com/FreeOpcUa/opcua-asyncio/issues/1013 · Exploit
• 🔥 https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709 · Exploit
• https://github.com/FreeOpcUa/opcua-asyncio/pull/1039 · Patch
• https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262 · Patch
• https://ubuntu.com/security/CVE-2023-26151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26151 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26151 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-190 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26151 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gfvq-mxw3-mfq3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26151 · Security Note
• https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96 · Note
• https://github.com/FreeOpcUa/opcua-asyncio · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/asyncua/PYSEC-2023-190.yaml · Note