4.7. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

4.7.1. [Critical] Potential out-of-bounds write in Connext when using any Persistence Service

Connext may have written out-of-bounds when using Persistence Service.

4.7.1.1. User Impact without Security

• Memory corruption leading to data corruption or a crash.

• Exploitable only by modifying the ODBC configuration files.

• CVSS v3.1 Base Score: 4.4 Medium

• CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

• CVSS v4.0 Base Score: 4.8 Medium

• CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

4.7.1.2. User Impact with Security

Same impact as described in “User Impact without Security” above.

[RTI Issue ID PERSISTENCE-510]