GitHub Advisoryadvisory · Maven

GHSA-pq4w-qm9g-qx68 Insufficient Nonce Validation in Eclipse Milo Client

HIGH Published 2020-03-16 Modified 2021-07-28 Official page ↗
Aliases
CVE-2019-19135
Ecosystem
Maven
Packages
org.eclipse.milo:sdk-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-330, CWE-522
Reviewed
2020-03-16

Affected packages

• Maven org.eclipse.milo:sdk-client: < 0.3.6 → fixed in 0.3.6

Description

Impact Credential replay affecting those connected to a server when *all 3* of the following conditions are met: • `SecurityPolicy` is `None` • using username/password or X509-based authentication • the server has a defect causing it to send null/empty or zeroed nonces Patches The problem has been patched in version `0.3.6`. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version `0.3.7`. Workarounds Do not use username/password or X509-based authentication with `SecurityPolicy` of `None`. References https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf For more information If you have any questions or comments about this advisory: • Open an issue at https://github.com/eclipse/milo/issues • Email the mailing list

Related

Alias · CVE (1)

  • CVE-2019-19135 In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in… vulnerability

Weakness · CWE (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References