The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.
References
Link | Resource |
---|---|
https://github.com/locka99/opcua/pull/216 | Third Party Advisory |
https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd | Patch Third Party Advisory |
https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750 | Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: snyk
Published: 2022-08-24T00:00:00
Updated: 2022-08-24T05:00:19
Reserved: 2022-02-24T00:00:00
Link: CVE-2022-25903
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-08-24T05:15:07.377
Modified: 2022-08-26T04:52:22.617
Link: CVE-2022-25903
JSON object: View
Redhat Information
No data.
CWE