GHSA-hgxq-hcrm-c5pm

ghsaUSosv

opcua Vulnerable to Out-of-bounds Write

view advisory published 2022-08-25Licence: CC-BY-4.0

The package opcua from 0.0.0 until 0.11.0 is vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-25903US	high7.5	1.43% (73rd)	—	2022-08-24
The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in…

references

External citations — patches, advisories, analysis.

https://github.com/locka99/opcuaPACKAGE
https://github.com/locka99/opcua/pull/216WEB
https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8ddWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-25903ADVISORY
https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan