Vulnerability Description
The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Open62541 | Open62541 | < 1.2.5 |
| Fedoraproject | Fedora | 37 |
Related Weaknesses (CWE)
References
- https://github.com/open62541/open62541/commit/b79db1ac78146fc06b0b8435773d3967dePatchThird Party Advisory
- https://github.com/open62541/open62541/pull/5173PatchThird Party Advisory
- https://github.com/open62541/open62541/releases/tag/v1.2.5Release NotesThird Party Advisory
- https://github.com/open62541/open62541/releases/tag/v1.3.1Release NotesThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.snyk.io/vuln/SNYK-UNMANAGED-OPEN62541OPEN62541-2988719PatchThird Party Advisory
- https://github.com/open62541/open62541/commit/b79db1ac78146fc06b0b8435773d3967dePatchThird Party Advisory
- https://github.com/open62541/open62541/pull/5173PatchThird Party Advisory
- https://github.com/open62541/open62541/releases/tag/v1.2.5Release NotesThird Party Advisory
- https://github.com/open62541/open62541/releases/tag/v1.3.1Release NotesThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.snyk.io/vuln/SNYK-UNMANAGED-OPEN62541OPEN62541-2988719PatchThird Party Advisory
FAQ
What is CVE-2022-25761?
CVE-2022-25761 is a vulnerability with a CVSS score of 7.5 (HIGH). The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session ...
How severe is CVE-2022-25761?
CVE-2022-25761 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-25761?
Check the references section above for vendor advisories and patch information. Affected products include: Open62541 Open62541, Fedoraproject Fedora.