Skip to content

v2.74.0
Compare
Choose a tag to compare
@erossignon erossignon released this 23 Aug 20:44
· 586 commits to master since this release
v2.74.0
003ee04

This important release fixes 3 CVEs that have been recently discovered.

*We strongly encourage you to upgrade your existing node-opcua to version 2.74.0 or greater and to contact Sterfive for support.

Only Sterfive's customers or members of the NodeOPCUA Subscription Membership are entitled to receive professional advice & support. You can apply online at https://support.sterfive.com .

‼️ vulnerabilities fixes

CVE-2022-21208
  • The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
CVE-2022-25231
  • The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
CVE-2022-24375
  • The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

🐛 bug fixes:

  • [902b288] server now returns ServiceFault response in case of error, instead of the corresponding Response of the Request command.
  • [3fd46ec] server: fix Subscription.modify that may cause server to crash;

©️ copyright update

  • node-opcua@2.74.0 is now copyrighted by Sterfive SAS. [902b288]

please make sure to comply with the MIT license and includes the attributions to Sterfive SAS for NodeOPCUA in the documentation that accompanies your application.

Copyright (c) 2022  Sterfive SAS - 833264583 RCS ORLEANS - France (https://www.sterfive.com)
Copyright (c) 2014-2022 Etienne Rossignon

👬 contributors

Assets 2