CVE-2020-27222
📋 TL;DR
This vulnerability in Eclipse Californium allows clients to cause a denial-of-service (DoS) by exploiting a DTLS handshake state error. The DTLS server enters a wrong internal state after a failed certificate-based handshake, requiring a server restart to recover. This affects systems using Eclipse Californium versions 2.3.0 through 2.6.0 with DTLS enabled.
💻 Affected Systems
- Eclipse Californium
📦 What is this software?
Californium by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of DTLS services requiring manual server restarts, potentially disrupting IoT or CoAP communications.
Likely Case
Intermittent DoS affecting DTLS connections, requiring administrative intervention to restart services.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and respond to attack attempts.
🎯 Exploit Status
Exploitation requires sending DTLS handshake requests but no special tools or authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.0
Vendor Advisory: https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844
Restart Required: Yes
Instructions:
1. Upgrade to Eclipse Californium 2.7.0 or later. 2. Replace the affected Californium library in your application. 3. Restart all services using Californium.
🔧 Temporary Workarounds
Disable DTLS
allTemporarily disable DTLS if certificate-based authentication is not required
Configure Californium to use plain CoAP without DTLS
Implement connection limiting
allLimit DTLS handshake attempts from single IP addresses
Use firewall rules or application-level rate limiting
🧯 If You Can't Patch
- Implement network segmentation to isolate DTLS servers from untrusted networks
- Deploy monitoring to detect abnormal DTLS handshake patterns and trigger alerts
🔍 How to Verify
Check if Vulnerable:
Check if using Eclipse Californium version 2.3.0-2.6.0 with DTLS enabled for certificate-based authenticationCheck Version:
Check application dependencies or Californium library version in build configurationVerify Fix Applied:
Verify Californium version is 2.7.0 or later and test DTLS handshake functionality📡 Detection & Monitoring
Log Indicators:
- Multiple DTLS handshake failures from same source
- DTLS server restart events
- Certificate validation errors followed by service degradation
Network Indicators:
- Abnormal DTLS handshake patterns
- Increased DTLS traffic from single sources
- DTLS connection timeouts
SIEM Query:
source="californium-logs" AND (message="DTLS handshake failure" OR message="certificate validation error") | stats count by src_ip