Vulnerability · Published Jul 29, 2022 · Assigned by eclipse

CVE-2022-2576

High 7.5

In plain English

A high-severity security flaw in Eclipse Californium from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)0.6%top 50.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.eclipse.californium:californium-core	2.7.3	GHSA-qq3j-44gw-cf6r
Maven	org.eclipse.californium:californium-core	3.6.0	GHSA-qq3j-44gw-cf6r

Affected products (as reported)

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Californium	2.0.0 – before unspecifiedunspecified – through 2.7.23.0.0 – before unspecifiedunspecified – through 3.5.0

Weakness: CWE-408

References

https://bugs.eclipse.org/580018 x_refsource_CONFIRM