Описание
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Impact
Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Patches
Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.
Workarounds
No work around; please upgrade to v3.1.5 or a newer version.
Пакеты
github.com/pion/stun/v3
<= 3.1.4
3.1.5
github.com/pion/stun/v2
<= 2.0.0
Отсутствует
github.com/pion/stun
<= 1.23.1
Отсутствует
Связанные уязвимости
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAdd ...