GitHub Advisoryadvisory · crates.io

GHSA-hgxq-hcrm-c5pm opcua Vulnerable to Out-of-bounds Write

HIGH Published 2022-08-25 Modified 2022-09-01 Official page ↗
Aliases
CVE-2022-25903
Ecosystem
crates.io
Packages
opcua
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-787
Reviewed
2022-09-01

Affected packages

• crates.io opcua: < 0.11.0 → fixed in 0.11.0

Description

The package opcua from 0.0.0 until 0.11.0 is vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.

Related

Alias · CVE (1)

  • CVE-2022-25903 The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows… vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References