CVE-2019-20786

Katalog CVE

CVSS 9.8 · Critical EPSS 3,0%

Kerentanan Improper Authentication pada pion dtls. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.

Rincian

Terbit di NVD

19 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 87,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pion/dtls/commit/fd73a5df2ff0e1fb6ae6a51e2777d7a16cc4f4e0 patch · advisory pihak ketiga
• https://github.com/pion/dtls/compare/v1.5.1...v1.5.2 patch · advisory pihak ketiga
• https://www.usenix.org/conference/usenixsecurity20/presentation/fiterau-brostean advisory pihak ketiga
• https://www.usenix.org/system/files/sec20fall_fiterau-brostean_prepub.pdf exploit · advisory pihak ketiga