CVE catalog

CVE-2022-29189

snowflake: CVE-2022-29189

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.15% · Oct 25, 2026

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansnowflakesid2.10.1-2fixed
Debiansnowflakeforky2.10.1-2fixed
Debiansnowflaketrixie2.5.1-1fixed
Debiansnowflakebookworm2.5.1-1fixed
Ubuntutelegrafpro1.19.2+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.2+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu2vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu2+esm2fixed
Ubuntusnowflakepro1.1.0-1vulnerable
Ubuntusnowflakepro1.1.0-2vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1+esm1vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1+esm2fixed
Ubuntusnowflakepro1.1.0-1vulnerable
Ubuntusnowflakepro1.1.0-2vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1+esm1vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1+esm2fixed
Ubuntutelegrafpro1.19.2+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.2+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu2vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu2+esm2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansnowflakesourcesid2.2.0-1not yet assignedNot reported[1011457]
Debiansnowflakesourceforky2.2.0-1not yet assignedNot reported[1011457]
Debiansnowflakesourcetrixie2.2.0-1not yet assignedNot reported[1011457]
Debiansnowflakesourcebookworm2.2.0-1not yet assignedNot reported[1011457]
Ubuntutelegrafdebpro1.21.4+ds1-0ubuntu2+esm2Not reportedUSN-7966-2Not reported
Ubuntusnowflakedebpro1.1.0-2ubuntu0.1+esm2Not reportedUSN-7966-1Not reported
Ubuntusnowflakedebpro1.1.0-2ubuntu0.1+esm2Not reportedUBUNTU-CVE-2022-29189Not reported
Ubuntutelegrafdebpro1.21.4+ds1-0ubuntu2+esm2Not reportedUBUNTU-CVE-2022-29189Not reported

[Debian bug #1011457]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-snowflake-dev]Fixed

    Source package: [snowflake]

    Details (2)

    • 2.5.1-1 · all · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

    • 2.5.1-1 · all · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

  • [snowflake-client]Fixed

    Source package: [snowflake]

    Details (2)

    • 2.5.1-1+b3 · amd64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

    • 2.5.1-1+b3 · arm64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

  • [snowflake-proxy]Fixed

    Source package: [snowflake]

    Details (2)

    • 2.5.1-1+b3 · amd64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

    • 2.5.1-1+b3 · arm64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]