CVE-2022-25304: Allocation of Resources Without Limits or Throttling

August 24, 2022 (updated August 30, 2022)

All versions of package opcua; all versions of package asyncua is vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

References

github.com/FreeOpcUa/python-opcua/issues/1466
github.com/advisories/GHSA-mfpj-3qhm-976m
nvd.nist.gov/vuln/detail/CVE-2022-25304
security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-2988731
security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730

Detect and mitigate CVE-2022-25304 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →