Skip to content

Improper length parameter handling

Critical
mitza-oci published GHSA-3fh3-f5vr-vgxw May 20, 2022

Package

OpenDDS (Source Code)

Affected versions

< 3.18.1

Patched versions

3.18.1

Description

https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02

Versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code.

Users who are deploying OpenDDS-based applications that can receive data from the internet should consider section 15.4 of the OpenDDS Developer's Guide: "Security Considerations."

Severity

Critical
9.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID

CVE-2021-38445

Weaknesses