CVE-2022-29190: Infinite loop in github.com/pion/dtls/v2
Summary
CVE-2022-29190: Infinite loop in github.com/pion/dtls/v2. Affects github.com/pion/dtls/v2 versions < 2.1.4. Fixed in 2.1.4. How to fix ↓
Also tracked for
- github.com/pion/dtls · Go
- snowflake · Debian:12
The same CVE-2022-29190 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/pion/dtls/v2 is a Go implementation of the Datagram Transport Layer Security (DTLS) protocol. It provides functionality for creating DTLS clients and servers, establishing secure connections, and handling handshake and fragmentation processes. This package is vulnerable to an infinite loop attack, where an attacker can send packets that cause the DTLS server or client to enter an infinite loop.
Vulnerability Detail
The vulnerability allows an attacker to send specially crafted packets that trigger an infinite loop in the DTLS server or client. This can lead to a denial of service (DoS) condition, where the affected server or client becomes unresponsive and unable to handle legitimate requests. The infinite loop can be triggered by exploiting certain functions and symbols in the package, such as Client, ClientWithContext, Dial, DialWithContext, Resume, Server, ServerWithContext, fragmentBuffer.pop, handshakeFSM.Run, and listener.Accept.
How To Fix
Minimum fixed version
2.1.4
This is the first release that contains the fix.
go get github.com/pion/dtls/v2@v2.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the package to the fixed version to mitigate the risk of the infinite loop attack.
Conclusion
The package github.com/pion/dtls/v2 is vulnerable to an infinite loop attack, which can lead to a denial of service condition. To mitigate this vulnerability, it is crucial to update the package to version 2.1.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pion/dtls/v2 →
FAQ
The vulnerability can lead to a denial of service (DoS) condition, rendering the affected DTLS server or client unresponsive and unable to handle legitimate requests.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
No, there is no known workaround for this vulnerability. It is necessary to update the package to the fixed version to mitigate the risk.
No, versions 0 through 2.1.3 of the package are vulnerable. The fix for the infinite loop issue is included in version 2.1.4 and later.
You can find more information about this vulnerability, including technical details and the fix, in the vulnerability report at https://pkg.go.dev/vuln/GO-2022-0460.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pion/dtls/v2.
