CVE-2022-29189

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub_MCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
piondtls
𝑥
< 2.1.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
snowflake
sid
2.5.1-1
fixed
trixie
2.5.1-1
fixed
bookworm
2.5.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pion
bionic
needs-triage
xenial
needs-triage
snowflake
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
telegraf
noble
dne
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored