High, CVSS 7.5MavenPublished
Eclipse Milo vulnerable to Resource Exhaustion (Denial of Service)
CVE-2022-25897 · GHSA-fph9-f5r6-vhqf
- Affected
- Maven org.eclipse.milo:sdk-server < 0.6.8
- Fixed in
- 0.6.8· Vendor fix available
- Issue
- Impact Denial of Service Details OPC UA specification describes a concept named Subscriptions. Subscriptions monitor a set of Monitored Items for Notifications and return them to the Client in response to Publish requests. The server notifies the client about changes only in case the value is changed. Each monitored item is configured on a subscription, each subscription is linked to a single OPC UA session. Most OPC UA implementations set many controls and limitations for excessive memory consumption. For example: What is the maximum allowed number of concurrent sessions For each active sessions - what is the maximum allowed number of concurrent subscription per a single session For each active subscription - what is the maximum allowed number of concurrent monitored items per a single subscription Clarity Research discovered a unique way to bypass those restrictions and fill up the OPC UA server process memory. The close session request closes a connected session. A…
Recommended action: Upgrade to 0.6.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.