Improper validation of sequence numbers leading to remotely reachable assertion failure
CVE-2023-39949

7.5HIGH

Key Information:

Vendor

Eprosima

Status
Fast-dds
Vendor
CVE Published:
11 August 2023

What is CVE-2023-39949?

The eprosima Fast DDS C++ implementation of the Data Distribution Service standard is affected by an assertion failure vulnerability caused by improper validation of sequence numbers. This flaw can be exploited by an attacker to remotely crash any Fast DDS process, disrupting normal operations. Users are advised to update to versions 2.9.1 or 2.6.5, which include patches to rectify this issue.

Affected Version(s)

Fast-DDS >= 2.7.0, < 2.9.1 < 2.7.0, 2.9.1

Fast-DDS < 2.6.5 < 2.6.5

References

https://github.com/eProsima/Fast-DDS/security/advisories/...
x_refsource_CONFIRM
https://github.com/eProsima/Fast-DDS/issues/3236
x_refsource_MISC
https://github.com/eProsima/Fast-DDS/blob/v2.9.0/src/cpp/...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.