GHSA-4xgv-j62q-h3rj Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
A remote attacker can crash the application by sending a malformed Hello Verify Request, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4xgv-j62q-h3rj?
GHSA-4xgv-j62q-h3rj is a denial of service vulnerability in github.com/pion/dtls, published on 7 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash.
This issue could be abused to cause a denial of service.
Workaround
None, upgrade to 2.2.4
Which versions are affected by GHSA-4xgv-j62q-h3rj?
5 open source packages ship an affected version, including github.com/pion/dtls/v2 and github.com/pion/dtls.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pion/dtls/v2 Go | All versions | 2.2.4 |
github.com/pion/dtls/v2 Go | All versions | 2.2.4 |
github.com/pion/dtls/v2 Go | All versions | 2.2.4 |
github.com/pion/dtls Go | All versions to 1.5.4 | None |
github.com/pion/dtls Go | All versions to 1.5.4 | None |
How do I fix GHSA-4xgv-j62q-h3rj?
Upgrade github.com/pion/dtls/v2 to 2.2.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-4xgv-j62q-h3rj being exploited?
There is no known exploitation of GHSA-4xgv-j62q-h3rj in the wild and no public exploit code.
Sources
Also known as GO-2023-1534.