Credential replay affecting those connected to a server when all 3 of the following conditions are met:
- SecurityPolicy
is None
- using username/password or X509-based authentication
- the server has a defect causing it to send null/empty or zeroed nonces
The problem has been patched in version 0.3.6
. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version 0.3.7
.
Do not use username/password or X509-based authentication with SecurityPolicy
of None
.
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf
If you have any questions or comments about this advisory: * Open an issue at https://github.com/eclipse/milo/issues * Email the mailing list
{ "nvd_published_at": "2020-03-16T16:15:00Z", "cwe_ids": [ "CWE-330", "CWE-522" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-03-16T20:59:53Z" }