Eclipse Californium vulnerabilities

4 CVEs affecting Eclipse Californium, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-39368, published 2022-11-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-27222, published 2021-02-03. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong…
CVE-2022-39368, published 2022-11-10. High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days. Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of…
CVE-2022-2576, published 2022-07-29. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially,…
CVE-2021-34433, published 2021-08-20. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the…