5.4. What’s Fixed in 7.1.0

[Critical]: System-stopping issue, such as a crash or data loss.
[Major]: Significant issue with no easy workaround.
[Minor]: Issue that usually has a workaround.
[Trivial]: Small issue, such as a typo in a log.

5.4.1. [Critical] Using dh_param_files Leaked Memory

Using the property tls.cipher.dh_param_files leaked memory when deleting the DomainParticipant. A memory checking tool, such as valgrind, would have reported the leak in the OpenSSL function PEM_read_bio_DHparams, which is called by the RTI function RTITLS_tmp_dhparam_callback. This problem only affected applications using OpenSSL 1.0.2 or applications communicating with applications using OpenSSL 1.0.2. For example, TLS Support 5.3 uses OpenSSL 1.0.2, but version 7.0.0 of TLS Support could still communicate with version 5.3, so the leak could also happen in version 7.0.0.

This problem has been fixed; memory will no longer be leaked in this scenario. For example, if TLS Support 7.1.0 communicates with an application using OpenSSL 1.0.2, the leak will not occur.

[RTI Issue ID COREPLG-641]

5.4.2. [Minor] Failure to Load a String-Based Private Key Leaked Memory

If you set the property tls.identity.private_key or tls.identity.rsa_private_key, and you either specified a wrong or missing value for the property tls.identity.private_key_password or specified a malformed private key, then memory would be leaked upon DomainParticipant creation failure. A memory checking tool, such as valgrind, would report the leak in the OpenSSL function BIO_new_mem_buf, which is called by the RTI function RTITLS_context_init.

This problem has been fixed. Memory will no longer be leaked in this scenario.

[RTI Issue ID COREPLG-643]

5.4.3. Fixes Related to Vulnerabilities

5.4.3.1. [Critical] Potential eavesdropping when using OpenSSL 1.1.1 due to a vulnerability in OpenSSL 1.1.1

TLS Support had a third-party dependency on OpenSSL 1.1.1, which is known to be affected by a number of publicly disclosed vulnerabilities.

These vulnerabilities have been fixed by upgrading OpenSSL to the latest stable version, 1.1.1t. See Upgrade OpenSSL to versions 1.1.1t and 3.0.8 for more details.

5.4.3.1.1. User Impact without Security

The impact on Connext applications of using the previous version was as follows:

• Exploitable by sending trial messages to a DDS Entity.

• The application’s confidential data could be decrypted by an attacker.

• CVSS Base Score: 5.9 MEDIUM

• CVSS v3.1 Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.4.3.1.2. User Impact with Security

Same impact as described in “User Impact without Security,” above.

[RTI Issue ID COREPLG-689]