CVE-2022-2576CWE-408

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without…

published July 29, 2022

CVSS
—
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00606 · 48.3th percentile
Weakness
CWE-408 · Incorrect Behavior Order: Early Amplification
Published
2022-07-29T13:20Z
EPSS history
Timeline
  • 29 JUL 13:20Z
    In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without…
    cvelistv5