CVE-2023-26151 - OpenCVE

Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Freeopcua	Opcua-asyncio

Configuration 1 [-]

cpe:2.3:a:freeopcua:opcua-asyncio:*:*:*:*:*:python:*:*

References

Link	Resource
https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8	Exploit Third Party Advisory
https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262	Patch
https://github.com/FreeOpcUa/opcua-asyncio/issues/1013	Exploit Issue Tracking Third Party Advisory
https://github.com/FreeOpcUa/opcua-asyncio/pull/1039	Patch
https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96	Product Release Notes
https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709	Exploit Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2023-10-03T05:00:01.093Z

Updated: 2023-10-03T05:00:01.093Z

Reserved: 2023-02-20T10:28:48.929Z

Link: CVE-2023-26151

JSON object: View

NVD Information

Status : Modified

Published: 2023-10-03T05:15:50.507

Modified: 2023-11-07T04:09:29.060

Link: CVE-2023-26151

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freeopcua:opcua-asyncio:*:*:*:*:*:python:*:*", "matchCriteriaId": "D64D2A05-90B8-43AA-B8BE-9D79959CFC61", "versionEndExcluding": "0.9.96", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory."}, {"lang": "es", "value": "Las versiones del paquete asyncua anteriores a la 0.9.96 son vulnerables a la denegaci\u00f3n de servicio (DoS), de modo que un atacante puede enviar un paquete con formato incorrecto y, como resultado, el servidor entrar\u00e1 en un bucle infinito y consumir\u00e1 memoria excesiva."}], "id": "CVE-2023-26151", "lastModified": "2023-11-07T04:09:29.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2023-10-03T05:15:50.507", "references": [{"source": "report@snyk.io", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8"}, {"source": "report@snyk.io", "tags": ["Patch"], "url": "https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/FreeOpcUa/opcua-asyncio/issues/1013"}, {"source": "report@snyk.io", "tags": ["Patch"], "url": "https://github.com/FreeOpcUa/opcua-asyncio/pull/1039"}, {"source": "report@snyk.io", "tags": ["Product", "Release Notes"], "url": "https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96"}, {"source": "report@snyk.io", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "report@snyk.io", "type": "Secondary"}]}