GitHub Advisoryadvisory · Go

GHSA-4xgv-j62q-h3rj Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

MEDIUM Published 2023-02-07 Modified 2023-06-13 Official page ↗

Ecosystem: Go
Packages: github.com/pion/dtls, github.com/pion/dtls/v2
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed: 2023-02-07

Affected packages

• Go github.com/pion/dtls: <= 1.5.4 (no fix yet) • Go github.com/pion/dtls/v2: < 2.2.4 → fixed in 2.2.4

Description

Impact During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. Workaround None, upgrade to 2.2.4

References

https://github.com/pion/dtls/security/advisories/GHSA-4xgv-j62q-h3rj web
https://github.com/pion/dtls/commit/a50d26c5e4eed2ca87509494ffef2d2ebd22b1eb web
https://github.com/pion/dtls package
https://pkg.go.dev/vuln/GO-2023-1534 web