CVE-2022-29190: Loop with Unreachable Exit Condition ('Infinite Loop')

May 24, 2022 (updated February 15, 2023)

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.

References

github.com/advisories/GHSA-cm8f-h6j3-p25c
github.com/pion/dtls/commit/e0b2ce3592e8e7d73713ac67b363a2e192a4cecf
github.com/pion/dtls/releases/tag/v2.1.4
github.com/pion/dtls/security/advisories/GHSA-cm8f-h6j3-p25c
nvd.nist.gov/vuln/detail/CVE-2022-29190
pkg.go.dev/vuln/GO-2022-0460

Code Behaviors & Features

Detect and mitigate CVE-2022-29190 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →