« Volver al listado

CVE-2020-27222

Estado: ModificadaAlta (7.5)—

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Eclipse — Californium

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-27222",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "emo@eclipse.org",
      "affectedData": [
        {
          "vendor": "The Eclipse Foundation",
          "product": "Eclipse Californium",
          "versions": [
            {
              "status": "affected",
              "version": "[2.3.0, 2.6.0]"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-03T16:15:13.117",
  "references": [
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "emo@eclipse.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-372"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS."
    },
    {
      "lang": "es",
      "value": "En Eclipse Californium versiones 2.3.0 hasta 2.6.0, los protocolos de enlace DTLS basados ??en certificados (x509 y RPK) cometen un fallo accidentalmente, porque el lado del servidor DTLS se adhiere a un estado interno equivocado. Ese estado interno equivocado es ajustado por medio de un fallo de protocolo de enlace DTLS basada en un certificado anterior con una falta de coincidencia de los parámetros TLS. El lado del servidor DTLS debe reiniciarse para recuperar esto. Esto permite a clientes forzar una DoS"
    }
  ],
  "lastModified": "2026-06-17T03:08:59.540",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:californium:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56884583-F1FF-412F-B5E6-0AD0F904F260",
              "versionEndIncluding": "2.6.0",
              "versionStartIncluding": "2.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "emo@eclipse.org"
}