Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
Summary
GHSA-hxp2-xqf3-v83h: Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2. Affects github.com/pion/dtls versions < 1.5.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/pion/dtls/v2 is a Go library that provides support for Datagram Transport Layer Security (DTLS) protocol. DTLS is a variant of the Transport Layer Security (TLS) protocol that is designed to provide security for datagram-based applications such as UDP. The package allows developers to implement DTLS functionality in their Go applications.
Vulnerability Detail
The vulnerability identified in the package is related to the unmarshaling of a Server Hello request. During this process, there is a possibility of attempting to unmarshal into a buffer that is too small, leading to a panic and crashing of the program. This vulnerability can be exploited to cause a denial of service (DoS) attack. The vulnerability has a CVSS score of 5.9, indicating a moderate severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the github.com/pion/dtls/v2 package allows for a panic during the unmarshaling process, leading to a program crash and potential denial of service. To fix this vulnerability, developers should update to version 2.2.4 or above. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/pion/dtls →
FAQ
The vulnerability can be exploited to cause a denial of service (DoS) attack by crashing the program.
DTLS is a variant of the TLS protocol designed for datagram-based applications such as UDP.
Unmarshaling is the process of converting serialized data into a structured format, such as converting binary data into Go objects.
A panic is a situation in Go where the program encounters an unexpected error or condition that it cannot recover from, resulting in a crash.
To prevent this vulnerability, ensure that you are using the latest version (2.2.4 or above) of the github.com/pion/dtls/v2 package.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pion/dtls.
