Vulnerability Description
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Node-Opcua Project | Node-Opcua | < 2.74.0 |
Related Weaknesses (CWE)
References
- https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9aPatchThird Party Advisory
- https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94ePatchThird Party Advisory
- https://github.com/node-opcua/node-opcua/pull/1149PatchThird Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723Third Party Advisory
- https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9aPatchThird Party Advisory
- https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94ePatchThird Party Advisory
- https://github.com/node-opcua/node-opcua/pull/1149PatchThird Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723Third Party Advisory
FAQ
What is CVE-2022-21208?
CVE-2022-21208 is a vulnerability with a CVSS score of 7.5 (HIGH). The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions...
How severe is CVE-2022-21208?
CVE-2022-21208 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-21208?
Check the references section above for vendor advisories and patch information. Affected products include: Node-Opcua Project Node-Opcua.