Infinite Loop Vulnerability in Pion DTLS Affecting Snowflake Packages
Summary
CVE-2022-29190: Pion DTLS is a Go implementation of Datagram Transport Layer Security. Affects snowflake across 3 version ranges.
< 2.2.0-1
< a6397ff7282bc56dc37a68ea9211702edb4de1de
< e0b2ce3592e8e7d73713ac67b363a2e192a4cecf
Fixed in 2.2.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pion DTLS is a Go implementation of Datagram Transport Layer Security, designed to provide secure communication over datagram networks. It is widely used in applications requiring real-time data transmission, such as video conferencing and online gaming. The vulnerability in question affects the Snowflake package in Debian 12 and 13, which relies on Pion DTLS for secure data transport. This vulnerability can lead to denial of service, making the affected applications unresponsive.
Vulnerability Detail
The vulnerability, identified as CVE-2022-29190, allows an attacker to send specially crafted packets that cause Pion DTLS to enter an infinite loop during packet processing. This can result in a denial of service, as the application becomes unresponsive and cannot process further requests. The issue was introduced in versions prior to 2.1.4 and has been patched in version 2.1.4. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade snowflakeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds available for this vulnerability. The best course of action is to apply the patch by updating the affected package.
Conclusion
CVE-2022-29190 is a significant vulnerability in Pion DTLS that affects the Snowflake package in Debian. It can lead to denial of service due to an infinite loop triggered by malicious packets. Users are advised to update to the patched version to mitigate the risk.
See every vulnerability recorded for snowflake →
FAQ
CVE-2022-29190 is a vulnerability in Pion DTLS that allows attackers to send packets causing an infinite loop, leading to denial of service.
If your application uses the affected Snowflake package, it may become unresponsive when processing malicious packets, impacting user experience.
Snowflake versions prior to 2.2.0-1 are affected by this vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for snowflake.
