CVE-2023-26151 : Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Servic

Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.

Published 2023-10-03 05:15:51

Updated 2023-10-04 17:12:34

Source Snyk

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-26151

Freeopcua » Opcua-asyncio » For Python
Versions before (<) 0.9.96
cpe:2.3:a:freeopcua:opcua-asyncio:*:*:*:*:*:python:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-26151

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-26151

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	Snyk
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2023-26151

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-26151

https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262

server handle malformed packets · FreeOpcUa/opcua-asyncio@f6603da · GitHub
Patch
https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96

Release v0.9.96 · FreeOpcUa/opcua-asyncio · GitHub
Product;Release Notes

CVEs referencing this url
https://github.com/FreeOpcUa/opcua-asyncio/issues/1013

Denial of Service · Issue #1013 · FreeOpcUa/opcua-asyncio · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8

DoS asyncua Server · GitHub
Exploit;Third Party Advisory
https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709

Denial of Service (DoS) in asyncua | CVE-2023-26151 | Snyk
Exploit;Patch;Third Party Advisory
https://github.com/FreeOpcUa/opcua-asyncio/pull/1039

server handle malformed packets by oroulet · Pull Request #1039 · FreeOpcUa/opcua-asyncio · GitHub
Patch

Jump to

Vulnerability Details : CVE-2023-26151

Products affected by CVE-2023-26151

Exploit prediction scoring system (EPSS) score for CVE-2023-26151

CVSS scores for CVE-2023-26151

CWE ids for CVE-2023-26151

References for CVE-2023-26151