CVE-2024-33862: OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability
Summary
CVE-2024-33862: OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability. Affects OPCFoundation.NetStandard.Opc.Ua.Core versions < 1.5.374.54. Fixed in 1.5.374.54. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OPCFoundation.NetStandard.Opc.Ua.Core is a NuGet package that provides core functionality for OPC Unified Architecture (UA) applications. It is used to develop and implement OPC UA servers and clients. OPC UA is a communication protocol for industrial automation that allows secure and reliable exchange of data between different devices and systems. The vulnerability in OPCFoundation.NetStandard.Opc.Ua.Core before version 1.5.374.54 could lead to a denial of service (DoS) condition when the system receives an excessive number of messages from a remote source.
Vulnerability Detail
The buffer-management vulnerability in OPCFoundation.NetStandard.Opc.Ua.Core allows remote attackers to exhaust memory resources. This vulnerability is triggered when the system receives an excessive number of messages from a remote source. As a result, the system's memory may be consumed, leading to a denial of service (DoS) condition. This can disrupt the normal operation of the system and potentially impact its availability and performance.
How To Fix
Minimum fixed version
1.5.374.54
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the OPCFoundation.NetStandard.Opc.Ua.Core package to the latest version.
Conclusion
The buffer-management vulnerability in OPCFoundation.NetStandard.Opc.Ua.Core could allow remote attackers to exhaust memory resources, leading to a denial of service (DoS) condition. It is crucial to update the package to version 1.5.374.54 or later to mitigate this vulnerability and ensure the normal operation and security of OPC UA applications.
See every vulnerability recorded for OPCFoundation.NetStandard.Opc.Ua.Core →
FAQ
OPCFoundation.NetStandard.Opc.Ua.Core is a NuGet package used for developing OPC UA servers and clients. It provides core functionality for implementing OPC UA applications.
A buffer-management vulnerability refers to a flaw in the management of memory buffers. In this case, the vulnerability in OPCFoundation.NetStandard.Opc.Ua.Core allows remote attackers to exhaust memory resources by sending an excessive number of messages.
A denial of service (DoS) condition occurs when a system becomes unavailable or unresponsive due to a resource exhaustion or overload. In the case of this vulnerability, the excessive messages can consume the system's memory, leading to a DoS condition.
The vulnerability can disrupt the normal operation of the system, potentially causing unavailability or performance degradation. It may also impact the reliability and responsiveness of OPC UA communication between devices and systems.
To fix this vulnerability, update the OPCFoundation.NetStandard.Opc.Ua.Core package to version 1.5.374.54 or later. This version includes a fix for the buffer-management vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for OPCFoundation.NetStandard.Opc.Ua.Core.
