5.2.23. Vulnerabilities
The following vulnerabilities are fixed in this release.
See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.
5.2.23.1. [Critical] Potential heap buffer read overflow in Connext applications when using a malicious license string
An out-of-bounds read on the heap could occur while parsing a malicious
license string property (e.g., dds.license.license_string) value.
User Impact without Security
A vulnerability in the Connext application could have resulted in the following:
Heap buffer overread while parsing a malicious license string.
Exploitable by overwriting the XML QoS document on the file system with a malicious XML QoS document.
Potential impact on confidentiality of Connext application.
CVSS v3.1 Base Score: 4.4 MEDIUM
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0 Base Score: 4.8 MEDIUM
CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
User Impact with Security
Same impact as described in “User Impact without Security” above.
[RTI Issue ID CORE-15693]
5.2.23.2. [Critical] Potential invalid read memory access in Connext applications when subscribing to PublicationBuiltinTopicData
An invalid read memory access in Connext applications could have
occurred after calling DDS_Subscriber_lookup_datareader to retrieve
the builtin publication information and then discovering a DataWriter.
User Impact without Security
A vulnerability in Connext applications while discovering a DataWriter could have resulted in the following:
Out-of-bounds read while parsing a malicious RTPS message.
Remotely exploitable.
Potential impact on the confidentiality of Connext applications.
Potential crash in the application.
CVSS v3.1 Base Score: 9.1 Critical
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0 Base Score: 8.3 High
CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
User Impact with Security
There is no impact when enabling certain Security features; see Mitigations for more information.
Mitigations
Use Security Plugins RTPS protection, discovery protection, or RTPS PSK protection.
Set verbosity to
NDDS_CONFIG_LOG_VERBOSITY_WARNINGor higher for theNDDS_CONFIG_LOG_CATEGORY_APIcategory.
[RTI Issue ID CORE-15730]
5.2.23.3. [Critical] Potential invalid read memory access in Connext applications during endpoint discovery
An invalid read memory access in Connext applications could have occurred while discovering a DataWriter or DataReader.
User Impact without Security
A vulnerability in Connext applications while discovering a DataWriter or DataReader could have resulted in the following:
Out-of-bounds read while parsing a malicious RTPS message.
Remotely exploitable.
Potential impact on the confidentiality of Connext applications.
Potential crash in the application.
CVSS v3.1 Base Score: 9.1 Critical
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0 Base Score: 8.3 High
CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
User Impact with Security
There is no impact when enabling certain Security features; see Mitigations for more information.
Mitigations
Use Security Plugins RTPS protection, discovery protection, or RTPS PSK protection.
[RTI Issue ID CORE-15789]