GMS-2023-256: Pion DTLS is vulnerable to panic via Hello Verify Request unmarshal

February 7, 2023 (updated August 23, 2023)

Impact

During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash.

This issue could be abused to cause a denial of service.

Workaround

None, upgrade to 2.2.4

References

github.com/advisories/GHSA-4xgv-j62q-h3rj
github.com/pion/dtls/commit/a50d26c5e4eed2ca87509494ffef2d2ebd22b1eb
github.com/pion/dtls/security/advisories/GHSA-4xgv-j62q-h3rj

Code Behaviors & Features

Detect and mitigate GMS-2023-256 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →