CVE-2022-29190highCWE-835

CVE-2022-29190: falha de alta gravidade em pion dtls

Header reconstruction method can be thrown into an infinite loop in Pion DTLS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar dtls+ Monitorar github.com/pion/dtls

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.7%
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
pion · dtls
CVEs relacionadas — pion dtls

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29189MEDIUMBuffer for inbound DTLS fragments has no limitEPSS 2.1%CVE-2022-29222MEDIUMImproper Certificate Validation in Pion DTLSEPSS 0.8%CVE-2026-26014MEDIUMPion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication keyEPSS 0.7%CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%