PT-2024-11019 · Unknown · Contiki-Ng

Jerrytesting · Published 2024-01-22 · Updated 2024-01-30 · CVE-2021-42141

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contiki-NG tinyDTLS versions through 2018-08-30

Description An issue was discovered where one incorrect handshake could complete with different epoch numbers in the packets Client Hello, Client key exchange, and Change cipher spec, which may cause denial of service.

Recommendations For Contiki-NG tinyDTLS versions through 2018-08-30, consider applying configuration changes to prevent incorrect handshakes with different epoch numbers, such as validating epoch numbers in the Client Hello, Client key exchange, and Change cipher spec packets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2021-42141

Affected Products

Contiki-Ng

References · 9

• https://github.com/contiki-ng/tinydtls/issues/27 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-42141 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42141 · Vendor Advisory
• https://t.me/cvenotify/68320 · Telegram Post
• https://twitter.com/CVEnew/status/1749560094185206087 · Twitter Post
• http://packetstormsecurity.com/files/176625/Contiki-NG-tinyDTLS-Denial-Of-Service.html · Note
• https://seclists.org/fulldisclosure/2024/Jan/14 · Note
• http://seclists.org/fulldisclosure/2024/Jan/14 · Note
• https://t.me/cvenotify/68265 · Telegram Post