CVE-2020-27222CWE-372

CVE-2020-27222: vulnerability in The Eclipse Foundation Eclipse Californium

Published · Updated

Follow this CVE+ Monitor Eclipse Californium

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.9%
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.
Affected products
The Eclipse Foundation · Eclipse Californium
Related CVEs — The Eclipse Foundation Eclipse Californium

In the same product, most dangerous first.

CVE-2022-2576—CVE-2022-2576EPSS 0.6%CVE-2021-34433—CVE-2021-34433EPSS 0.3%