PT-2024-11020 · Unknown · Contiki-Ng

Jerrytesting · Published 2024-01-23 · Updated 2024-10-21 · CVE-2021-42142

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contiki-NG tinyDTLS through master branch 53a0d97

Description An issue in DTLS servers allows remote attackers to cause a denial of service and false-positive packet drops due to the mishandling of the early use of a large epoch number.

Recommendations For Contiki-NG tinyDTLS through master branch 53a0d97, consider implementing measures to handle large epoch numbers correctly in DTLS servers to prevent denial of service and false-positive packet drops. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Allocation of Resources Without Limits

Weakness Enumeration

CWE-755

CWE-770

Related Identifiers

CVE-2021-42142

Affected Products

Contiki-Ng

References · 8

• https://github.com/contiki-ng/tinydtls/issues/24 · Patch
• https://osv.dev/vulnerability/CVE-2021-42142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42142 · Security Note
• https://t.me/cvenotify/98922 · Telegram Post
• https://t.me/cvenotify/68430 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Jan/15 · Note
• https://t.me/cvenotify/69337 · Telegram Post
• https://seclists.org/fulldisclosure/2024/Jan/15 · Note