CVE-2022-39368
- EPSS 0.1%
- Veröffentlicht 10.11.2022 00:15:10
- Zuletzt bearbeitet 21.11.2024 07:18:08
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for ...
CVE-2022-2576
- EPSS 0.2%
- Veröffentlicht 29.07.2022 14:15:08
- Zuletzt bearbeitet 21.11.2024 07:01:16
In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that r...
CVE-2021-34433
- EPSS 0.05%
- Veröffentlicht 20.08.2021 17:15:07
- Zuletzt bearbeitet 21.11.2024 06:10:24
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in ...
CVE-2020-27222
- EPSS 0.23%
- Veröffentlicht 03.02.2021 16:15:13
- Zuletzt bearbeitet 21.11.2024 05:20:53
In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DT...