Specially crafted RTPS message may cause an OpenDDS application to crash
CVE-2023-23932

5.3MEDIUM

Key Information:

Vendor

Opendds

Status
Opendds
Vendor
CVE Published:
3 February 2023

What is CVE-2023-23932?

OpenDDS, an open source C++ implementation of the Object Management Group's Data Distribution Service (DDS), is susceptible to application crashes when it encounters malformed input over untrusted RTPS network traffic. This vulnerability poses a risk to applications relying on OpenDDS for data distribution. A security update has been released in version 3.23.1, effectively addressing this issue.

Affected Version(s)

OpenDDS < 3.23.1

References

https://github.com/OpenDDS/OpenDDS/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.