GitHub Advisoryadvisory · Go

GHSA-hxp2-xqf3-v83h Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2

MEDIUM Published 2023-02-07 Modified 2023-06-13 Official page ↗
Ecosystem
Go
Packages
github.com/pion/dtls, github.com/pion/dtls/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Reviewed
2023-02-07

Affected packages

• Go github.com/pion/dtls: <= 1.5.4 (no fix yet) • Go github.com/pion/dtls/v2: < 2.2.4 → fixed in 2.2.4

Description

Impact When attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. Workaround None

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References