GitHub Advisoryadvisory · NuGet

GHSA-vhfw-v69p-crcw Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core

HIGH Published 2022-06-17 Modified 2022-09-01 Official page ↗

Aliases: CVE-2022-29864
Ecosystem: NuGet
Packages: OPCFoundation.NetStandard.Opc.Ua.Core
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-400
Reviewed: 2022-06-17

Affected packages

• NuGet OPCFoundation.NetStandard.Opc.Ua.Core: < 1.4.368.58 → fixed in 1.4.368.58

Description

A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception by sending a large number of message chunks.

Alias · CVE (1)

CVE-2022-29864 OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger… vulnerability

Weakness · CWE (1)

CWE-400 Uncontrolled Resource Consumption weakness

References

https://github.com/OPCFoundation/UA-.NETStandard/security/advisories/GHSA-vhfw-v69p-crcw web
https://nvd.nist.gov/vuln/detail/CVE-2022-29864 advisory
https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29864.pdf web
https://github.com/OPCFoundation/UA-.NETStandard package