Specially-crafted RTPS messages may cause an OpenDDS application to crash

High

mitza-oci published GHSA-8wvq-25f5-f8h4

Feb 1, 2023

Package

OpenDDS

Affected versions

< 3.23.1

Patched versions

3.23.1

Description

Impact

OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input.

Patches

Patched in Pull Requests #4010, #4016, #4018 and fixed in release 3.23.1

Workarounds

n/a

References

Section 15.4 of the OpenDDS Developer's Guide details Security Considerations for running internet-exposed OpenDDS applications.

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H