CVE-2023-26151: Denial of Service (DoS) in asyncua package
Summary
CVE-2023-26151: Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive... Affects asyncua across 2 version ranges.
< 0.9.96
< f6603daa34a93a658f0e176cb0b9ee5a6643b262
Fixed in f6603daa34a93a658f0e176cb0b9ee5a6643b262. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The asyncua package is a Python library that provides an asynchronous client and server implementation of the OPC UA (Open Platform Communications Unified Architecture) protocol. It allows developers to create OPC UA servers and clients for industrial automation and control systems. The package is widely used in various industries for building distributed systems and IoT applications.
Vulnerability Detail
The asyncua package before version 0.9.96 is vulnerable to a Denial of Service (DoS) attack. An attacker can exploit this vulnerability by sending a specially crafted packet to the server. As a result, the server enters an infinite loop, consuming excessive memory and causing a DoS condition. This vulnerability can be exploited remotely without authentication, potentially leading to service disruption and resource exhaustion.
How To Fix
Minimum fixed version
f6603daa34a93a658f0e176cb0b9ee5a6643b262
This is the first release that contains the fix.
pip install --upgrade "asyncua==f6603daa34a93a658f0e176cb0b9ee5a6643b262"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the asyncua package.
Conclusion
The asyncua package before version 0.9.96 is vulnerable to a DoS attack that can be exploited remotely without authentication. To mitigate this vulnerability, it is crucial to upgrade to asyncua version 0.9.96 or later. This upgrade ensures that the server properly handles malformed packets, preventing the DoS condition. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asyncua →
FAQ
The asyncua package is a Python library for implementing OPC UA servers and clients in an asynchronous manner.
This vulnerability allows an attacker to cause a DoS condition on a server using the asyncua package, leading to service disruption and resource exhaustion.
Yes, this vulnerability can be exploited remotely without authentication.
Yes, upgrading to asyncua version 0.9.96 or later fixes this vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for asyncua.
