Vulnerability · Published Feb 3, 2021 · Assigned by eclipse
CVE-2020-27222
High 7.5
In plain English
A high-severity security flaw in Eclipse Californium from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Eclipse Foundation | Eclipse Californium | [2.3.0, 2.6.0] |
Weakness: CWE-372
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844 x_refsource_CONFIRM