Denial of Service Vulnerability in Python OPC UA Package
Summary
UBUNTU-CVE-2022-25304: All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent se... Affects python-opcua versions 0.90.3-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python OPC UA package is a library that implements the OPC UA (Open Platform Communications Unified Architecture) protocol, which is widely used for industrial automation and data exchange. It provides functionalities for building client and server applications that communicate over the OPC UA protocol. The package is essential for developers working in environments that require secure and reliable data transfer between devices. However, it is susceptible to a Denial of Service (DoS) vulnerability due to a lack of limitations on the number of received chunks per session.
Vulnerability Detail
All versions of the Python OPC UA package are vulnerable to a Denial of Service (DoS) attack. This vulnerability arises from the absence of restrictions on the number of large chunks that can be sent to a server in a single session or across multiple concurrent sessions. An attacker can exploit this flaw by sending an unlimited number of oversized chunks (e.g., 2GB each) without sending the final closing chunk, potentially overwhelming the server and causing it to become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on the server side to restrict the number of chunks that can be processed in a given time frame. This can help mitigate the impact of the vulnerability until a patch is applied.
Conclusion
In summary, the Python OPC UA package has a critical Denial of Service vulnerability that can be exploited by sending excessive large chunks of data. Users are advised to update their packages to the latest versions to mitigate this risk. Implementing rate limiting can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-opcua →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of the Python OPC UA package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include server downtime and denial of service, which can disrupt operations and affect user access to services.
Yes, a permanent fix is available by updating to the patched version of the Python OPC UA package.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-opcua.
