CVE-2022-29189: pion dtls Classic Buffer Overflow

Vulnerability summary

CVE-2022-29189 is a medium (CVSS 5.3) Classic Buffer Overflow vulnerability in pion dtls. EPSS estimates a 2.15% chance of exploitation in the next 30 days, higher than 81.8% of scored vulnerabilities.

Timeline

1. 20-05-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.