~ / search / GHSA-7gfg-6934-mqq2

GHSA-7gfg-6934-mqq2

Improper Authenication in Pion DTLS

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-20786

Packages

EcosystemPackageAffectedFixed in
Go github.com/pion/dtls < 1.5.2 1.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.

References

External links from the advisory. They lead to third-party sites.