GHSA-9f52-hpvw-v96w

    Dashboard / Vulnerabilities / GHSA-9f52-hpvw-v96w

    GHSA-9f52-hpvw-v96w

    Published: 10 Feb 2022Last Modified: 8 Nov 2023

    Summary: Improper Validation of Specified Quantity in Input in Eclipse Hono

    Details: In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-27217, https://bugs.eclipse.org/bugs/show_bug.cgi?id=567068

    Affected packages

    Package

    Name: org.eclipse.hono:hono-core

    Purl: pkg:maven/org.eclipse.hono/hono-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.4.3

    Affected versions

    0.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-9f52-hpvw-v96w | CVE-DB