Bug 1930230 (CVE-2020-27222)

Summary:	CVE-2020-27222 californium-core: DTLS - DoS vulnerability for certificate based handshakes
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, bibryam, chazlett, drieden, ganandan, ggaughan, gmalinko, hbraun, janstey, jnethert, jochrist, jwon, pantinor
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	californium-2.6.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in californium. The certificate based (x509 and RPK) DTLS handshakes fails due to the DTLS server side being set to a wrong internal state by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-08-18 13:28:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1924976

Description msiddiqu 2021-02-18 14:35:45 UTC

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.


References:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844

Comment 1 Jonathan Christison 2021-02-18 16:11:42 UTC

Marking Red Hat Fuse 7 and Red Hat Integration Camel K as having a moderate impact as although the vulnerable org.eclipse.californium:scandium:jar:* artifact is used as part of camel-coap the impact is lessened due to the following reasons -

* A successful attack on the component would not result in a total loss of availability. 

* Only the coaps (UDP + DTLS) protocol is impacted by this flaw, this increases the attack complexity as the configuration of camel-coap is beyond the attackers control.

Further extenuating factors which we have not taken into account for the impact of this flaw but which might be a factor in considering the risk an end application may be exposed to, is that CoAP networks are often not accessible to WAN traffic, therefore the attack vector would likely be Adjacent as opposed to Network in those situations.

Comment 6 errata-xmlrpc 2021-08-18 09:13:41 UTC

This issue has been addressed in the following products:

  Red Hat Integration

Via RHSA-2021:3205 https://access.redhat.com/errata/RHSA-2021:3205

Comment 7 errata-xmlrpc 2021-08-18 09:55:13 UTC

This issue has been addressed in the following products:

  Red Hat Integration

Via RHSA-2021:3207 https://access.redhat.com/errata/RHSA-2021:3207

Comment 8 Product Security DevOps Team 2021-08-18 13:28:17 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27222