CVE-2019-19135 Insufficient Nonce Validation in Eclipse Milo Client
Insufficient randomness in OPC UA .NET Standard allows man-in-the-middle attackers to reuse encrypted user credentials, risking account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19135?
CVE-2019-19135 is a high-severity vulnerability in n/a, published on 16 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.
Weakness: CWE-330
Which versions are affected by CVE-2019-19135?
2 open source packages ship an affected version, including org.eclipse.milo:sdk-client. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.milo:sdk-client Maven | All versions | 0.3.6 |
org.eclipse.milo:sdk-client Maven | All versions | 0.3.6 |
Products include Opcfoundation Netstandard.opc.ua, Opcfoundation Ua-.Netstandard.
How do I fix CVE-2019-19135?
Upgrade org.eclipse.milo:sdk-client to 0.3.6 or later.
Is CVE-2019-19135 being exploited?
There is no known exploitation of CVE-2019-19135 in the wild and no public exploit code.
Sources
Also known as GHSA-pq4w-qm9g-qx68.