Sean DuBois

4 exploits Active since Apr 2020
CVE-2019-20786 WRITEUP CRITICAL WRITEUP
Pion DTLS < 1.5.2 - Unauthenticated Arbitrary Data Injection via Epoch 0 Application Data
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
CVSS 9.8
CVE-2022-29189 WRITEUP MEDIUM WRITEUP
Pion DTLS <2.1.4 - Memory Corruption
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
CVSS 5.3
CVE-2022-29190 WRITEUP HIGH WRITEUP
Pion DTLS < 2.1.4 - Denial of Service via Infinite Loop
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
CVSS 7.5
CVE-2022-29222 WRITEUP MEDIUM WRITEUP
Pion DTLS < 2.1.5 - Improper Certificate Validation
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
CVSS 5.9