CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-04-19

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Dtls (Pion)

References

• https://github.com/pion/dtls/commit/fd73a5df2ff0e1fb6ae6a51e2777d7a16cc4f4e0
• https://github.com/pion/dtls/compare/v1.5.1...v1.5.2
• https://www.usenix.org/conference/usenixsecurity20/presentation/fiterau-brostean
• https://www.usenix.org/system/files/sec20fall_fiterau-brostean_prepub.pdf