OpenWeave security bulletin
This bulletin contains the details of the security fixes that have been deployed as a part of this patch. See Table 1 for the references and details of the vulnerabilities that have been been remediated as a part of this fix.
Table 1. Security fixes for Weave vulnerabilities reported by Talos Labs
|Weave Legacy Pairing Information Disclosure Vulnerability
|Weave PASE pairing brute force vulnerability
|Weave KeyError denial-of-service vulnerability
|WeaveCASEEngine::DecodeCertificateInfo denial-of-service vulnerability
|OpenWeave Weave tool Print-TLV code execution vulnerability
|OpenWeave Weave ASN1Writer PutValue Code Execution Vulnerability
|OpenWeave Weave DecodeMessageWithLength Information Disclosure Vulnerability
|Nest Cam IQ Indoor Weave TCP connection denial-of-service vulnerability
We would like to thank Lilith Wyatt and Yves Younan from Talos Labs for reporting these vulnerabilities.