CVE-2002-20001

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2002-20001 has a selected CVSS score of 7.5 (high); EIP currently links 3 repository PoCs and 2 lab environments.

Description

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3
Lab environments
2

Proofs of concept

3

Repository PoCs

GitHubitmaniac/dheat_dos_attack_pocRepository PoCby itmaniac0Not analyzed2 files

9.0 KiB

GitHub
PoC details
GitHubc0r0n3r/dheaterRepository PoCby c0r0n3r217Not analyzed48 files

80.6 KiB

GitHub
PoC details
GitLabdheatattack/dheaterRepository PoCby dheatattack0Not analyzed48 files

195.0 KiB

GitLab
PoC details

Docker lab environments

2
GitHub

Repository root

c0r0n3r/dheaterCreated Vuln labCVE-2002-20001Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a container for D(HE)ater, a proof-of-concept denial-of-service tool that enforces Diffie-Hellman key exchange against TLS/SSH servers. The container runs as 'nobody' and executes the 'dheat' command.

Dockerfile:1-14

Lab assessment

Vulnerability lab

The repository explicitly describes itself as a proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001), a denial-of-service vulnerability. The Dockerfile packages this tool, and the README, CHANGELOG, and other documentation confirm its purpose for defensive testing and research.

README.md:1-10CHANGELOG.md:1-5CITATION.cff:1-10
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the D(HE)ater container image

Uses python:3.13-slim, copies the source into /usr/src/dheater, installs the package with pip, switches to user nobody, and sets the entrypoint to 'dheat' with default '--help'.

Dockerfile:1-14

dheater Python package

implements the D(HE)at attack logicprovides the 'dheat' CLI entrypointprovides the 'dh_param_priv_key_size_setter' helper

Contains the main attack script (dheater/__main__.py) that performs pre-checks, enforces DHE/ECDHE key exchange over TLS or SSH, and manages threads. Also includes a helper to set private key size in DH parameter files.

dheater/__main__.py:1-760dheater/dh_param_priv_key_size_setter.py:1-56pyproject.toml:48-50

DH parameter files

provide well-known DH parameters for the attack

A collection of PEM-encoded DH parameter files (ffdhe and modp groups) in various key sizes, used by the tool to forge ephemeral keys.

data/dhparam-ffdhe-2048.pem:1-8data/dhparam-modp-2048.pem:1-8

Fail2Ban filters

provide detection rules for D(HE)at attack patterns

Fail2Ban configuration files for Apache and Dovecot to detect SSL/TLS handshake interruptions caused by the attack.

fail2ban/apache-ssl.conf:1-13fail2ban/dovecot-ssl.conf:1-16

CI/CD pipeline

automates testing and Docker image publishing

GitLab CI configuration runs linting, unit tests, and builds/pushes the Docker image to Docker Hub with a description referencing CVE-2002-20001.

.gitlab-ci.yml:1-54
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2002-20001

Supported by supplied evidence

The entire repository is dedicated to demonstrating CVE-2002-20001. The README, CHANGELOG, CITATION.cff, pyproject.toml, and CI configuration all explicitly associate the tool with this CVE.

README.md:1-10CHANGELOG.md:1-5CITATION.cff:1-10pyproject.toml:7.gitlab-ci.yml:50
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Python 3.9 or newer is required to run the tool.pyproject.toml:18
  • The target server must support DHE or ECDHE key exchange over TLS or SSH.dheater/__main__.py:1-760
  • The user must specify a target URI and protocol (--protocol tls|ssh).README.md:27-33

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile.Dockerfile:1-14
  2. Run the container with the 'dheat' command, providing the target protocol and URI (e.g., 'dheat --protocol tls example.com:443').README.md:27-33
  3. The tool performs a pre-check to confirm DHE/ECDHE support, then launches threads that continuously send forged key exchange messages to saturate the server's CPU.dheater/__main__.py:1-760
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile builds a tool explicitly designed to attack external TLS/SSH servers. It does not contain any instructions that target the Docker host, escape the container, persist data, steal credentials, or connect to external systems beyond the user-specified target. The container runs as 'nobody' and the entrypoint is the attack tool itself. All behavior is consistent with a vulnerability research lab.

Dockerfile:1-14dheater/__main__.py:1-760
Review boundaries

What the analysis did not establish

  • The packet does not include a Compose file, so multi-service orchestration is not assessed.
  • The Dockerfile uses 'ADD . /usr/src/dheater', which copies the entire build context; the exact contents of the build context are not fully enumerated beyond the provided evidence files.
  • The tool's network behavior is directed at a user-supplied target; the safety verdict assumes the user follows the documented responsible-use policy.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitLab

Repository root

dheatattack/dheaterCreated Vuln labCVE-2002-20001Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile that builds a Python 3.13-slim image containing the D(HE)ater tool, a proof-of-concept for the D(HE)at denial-of-service attack (CVE-2002-20001). The image runs as 'nobody' and executes the 'dheat' command by default.

Dockerfile:1-14

Lab assessment

Vulnerability lab

The Dockerfile packages a tool explicitly described as a proof-of-concept for CVE-2002-20001, a denial-of-service attack. The README, CHANGELOG, and other documentation consistently frame the project as a vulnerability research and testing tool.

Dockerfile:1-14README.md:1-10CHANGELOG.md:1-5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

D(HE)ater tool

vulnerability PoCDoS attack toolcommand-line application

A Python command-line tool that enforces Diffie-Hellman ephemeral (DHE) or elliptic-curve Diffie-Hellman ephemeral (ECDHE) key exchange against TLS and SSH services to saturate server CPU. It uses CryptoLyzer for protocol analysis and traffic generation.

README.md:1-10dheater/__main__.py:1-759

DH parameter private key size setter

utilityDH parameter modifier

A helper tool that reads a DH parameter file and sets or removes the suggested private key size, outputting the modified PEM.

dheater/dh_param_priv_key_size_setter.py:1-55

Fail2Ban filters

defensive configurationlog parsing

Fail2Ban filter configuration files for Apache and Dovecot SSL/TLS handshake interruptions, likely intended to help detect or mitigate the D(HE)at attack.

fail2ban/apache-ssl.conf:1-13fail2ban/dovecot-ssl.conf:1-16
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2002-20001

Supported by supplied evidence

The project is explicitly described as the proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001) in multiple files, including README, CHANGELOG, CITATION.cff, and the CI configuration.

README.md:1-10CHANGELOG.md:1-5CITATION.cff:1-10.gitlab-ci.yml:1-63
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Python 3.9 or newer is required to run the tool.README.md:1-10pyproject.toml:1-65
  • A target TLS or SSH service that supports DHE or ECDHE key exchange must be accessible.README.md:1-10dheater/__main__.py:1-759

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile.Dockerfile:1-14
  2. Run the container with the 'dheat' command, specifying the target protocol and URI (e.g., 'dheat --protocol tls example.com:443').README.md:1-10dheater/__main__.py:1-759
  3. Observe the tool's output indicating the target's key exchange parameters and the attack threads running.dheater/__main__.py:1-759
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile builds a known vulnerability PoC tool and runs it as a non-root user. The tool's behavior is directed at a user-specified target service, which is the intended lab exercise. There is no evidence of hidden host compromise, credential theft, data destruction, or external backdoor behavior.

Dockerfile:1-14dheater/__main__.py:1-759
Review boundaries

What the analysis did not establish

  • The packet contains no Compose file; the environment is a single Dockerfile without orchestration.
  • The Dockerfile does not expose ports or mount host directories, so the attack surface is limited to outbound connections.
  • The tool's actual network behavior depends on runtime arguments; the static evidence only shows the code and documentation.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 14