NVD Vulnerability Detail

CVE-2020-28349

Summary	An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.
Publication Date	Nov. 9, 2020, 10:15 a.m.
Registration Date	Jan. 26, 2021, 11:56 a.m.
Last Update	Nov. 21, 2024, 2:22 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:chirpstack:network_server:3.9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://github.com/brocaar/chirpstack-network-server/commit/874fc1a9b01045ebe8a340f0bb01ed19e8256e60	Patch Third Party Advisory
2	https://github.com/brocaar/chirpstack-network-server/commit/874fc1a9b01045ebe8a340f0bb01ed19e8256e60	Patch Third Party Advisory
3	https://github.com/brocaar/chirpstack-network-server/commit/f996bb0c6c85281b5658f59ff09db1b4a73db453	Patch Third Party Advisory
4	https://github.com/brocaar/chirpstack-network-server/commit/f996bb0c6c85281b5658f59ff09db1b4a73db453	Patch Third Party Advisory
5	https://www.cyberark.com/resources/threat-research-blog/lorawan-mqtt-what-to-know-when-securing-your-iot-network	Exploit Third Party Advisory
6	https://www.cyberark.com/resources/threat-research-blog/lorawan-mqtt-what-to-know-when-securing-your-iot-network	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

ChirpStack Network Server における入力確認に関する脆弱性

Title	ChirpStack Network Server における入力確認に関する脆弱性
Summary	未確定本件は、脆弱性として確定していません。 ChirpStack Network Server には、入力確認に関する脆弱性が存在します。ベンダは、本脆弱性に対して異議を唱えています。詳細については、以下の NVD の Current Description を確認してください。 https://nvd.nist.gov/vuln/detail/CVE-2020-28349
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 9, 2020, midnight
Registration Date	June 22, 2021, 3:50 p.m.
Last Update	June 22, 2021, 3:50 p.m.

Affected System

Orne Brocaar

ChirpStack Network Server 3.9.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-28349	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28349
National Vulnerability Database (NVD)
2	CVE-2020-28349	https://nvd.nist.gov/vuln/detail/CVE-2020-28349

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
GitHub
1	Improve error handling of unknown gateways.	https://github.com/brocaar/chirpstack-network-server/commit/874fc1a9b01045ebe8a340f0bb01ed19e8256e60
2	Improve uplink de-duplication.	https://github.com/brocaar/chirpstack-network-server/commit/f996bb0c6c85281b5658f59ff09db1b4a73db453

Change Log

No	Changed Details	Date of change
1	[2021年06月22日] 掲載	June 22, 2021, 3:50 p.m.