DTLS Vulnerability in Eclipse Californium Affects Multiple Versions
CVE-2022-2576

7.5HIGH

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Californium
Vendor
CVE Published:
29 July 2022

What is CVE-2022-2576?

The Eclipse Californium product versions 2.0.0 to 3.5.0 are affected by a vulnerability wherein a DTLS resumption handshake not correctly handled defaults to a complete DTLS handshake due to a parameter mismatch. This leads to situations where, particularly in certificate-based cipher suites, message amplification can occur, leading to potential denial of service (DoS) conditions impacting the affected peer due to high CPU load. The misbehavior is triggered under specific configurations where DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values exceed zero. This poses a significant risk in network environments utilizing these versions.

Affected Version(s)

Eclipse Californium 2.0.0

Eclipse Californium <= 2.7.2

Eclipse Californium 3.0.0

References

https://bugs.eclipse.org/580018
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.