Summary
USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the
corresponding updates for Telegraf.
Original advisory details:
It was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit
on the amount of data that was buffered during the handshake. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29189)
It was discovered that Pion DTLS, vendored in Telegraf, did not prevent the
fragmentBuffer from processing zero length fragments. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29190)
It was discovered that Pion DTLS, vendored in Telegraf, did not require
CertificateVerify when Client Cert was sent. An attacker could
possibly use the issue to cause a denial of service. (CVE-2022-29222)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | telegraf | 1.21.4+ds1-0ubuntu2+esm2 |
Vulnerabilities 3
-
High 7.5
Header reconstruction method can be thrown into an infinite loop in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known…
-
Medium 5.9
Improper Certificate Validation in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Clien…
-
Medium 5.3
Buffer for inbound DTLS fragments has no limit
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes…