15.4. What’s Fixed in 7.7.0

This section describes bugs fixed in Routing Service 7.7.0. These are fixes since 7.6.0.

Connext 7.7.0 is the first production release in the 7.7 long-term support (LTS) series. It is built upon and combines all of the fixes in releases 7.4.0, 7.5.0, and 7.6.0 (see Previous Releases). See the Connext Versions and Lifecycle page for more information on RTI’s software release model.

For what’s fixed in other products in the Connext suite, see those products’ release notes on the RTI Community Portal or in your installation.

[Critical]: System-stopping issue, such as a crash or data loss.
[Major]: Significant issue with no easy workaround.
[Minor]: Issue that usually has a workaround.
[Trivial]: Small issue, such as a typo in a log.

15.4.1. [Critical] Samples not delivered by Routing Service using filter propagation after filter change

Routing Service may have lost samples when using filter propagation and upon detecting a filter change in one of the matching DataReaders. Samples were received and acknowledged by Routing Service’s Input DataReader, yet they were never sent by the Output DataWriter. A timing issue when processing filter changes prevented it: Routing Service used an outdated filter.

[RTI Issue ID ROUTING-1350]

15.4.2. [Critical] Routing Service did not disable fast forwarding for incompatible types, causing write errors and data loss

When publishing different versions of the same type, Routing Service failed to identify type incompatibilities related to fast forwarding (simple route optimization). The incoming type was not identified as incompatible with the optimization. When the sample was routed, the write operation failed with this message:

DDS_DynamicData2TypePlugin_serialize:not enough space to copy CDR buffer

[RTI Issue ID ROUTING-1317]

15.4.3. [Minor] Routing Service failed to launch without command-line parameters

This issue was fixed in release 7.4.0, but not documented at that time.

When attempting to launch Routing Service without using command-line parameters, it should run normally using the default configuration. Instead, Routing Service failed with the message:

$ bin\rtiroutingservice.bat
ERROR ROUTERService_load:!service configuration not specified and remote access not enabled
ERROR ROUTERService_initialize:!load service
ERROR ROUTERService_newWithDescription:!init service
ERROR RTI_RoutingService_new_from_description:!init routing service
ERROR ROUTERServiceApp_main:!create router service

[RTI Issue ID ROUTING-1187]

15.4.4. [Trivial] Misleading warning displayed when filter propagation enabled and a DataReader with no filter was discovered

When filter propagation was enabled, Routing Service may have displayed a misleading warning when a DataReader with an empty filter (i.e., the DataReader receives all published data samples) was discovered:

WARNING ROUTERDdsStreamWriter_onNewFiltersAvailable:Found new filter but there was a mismatch (invalid filter kind or filter expression not available); filter will now be set to all-pass

This warning was benign but misleading because this case is part of normal operation.

[RTI Issue ID ROUTING-1380]

15.4.5. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

15.4.5.1. [Critical] Potential heap buffer write overflow and memory leak in Connext applications when parsing an XML type

There was a possible heap buffer overwrite and memory leak when parsing an XML type.

15.4.5.1.1. User Impact without Security

This vulnerability affected the Core Libraries and all Infrastructure Services that rely on the Core Libraries.

15.4.5.1.2. User Impact with Security

Similar to “User Impact without Security”; security reduces the Attack Vector by protecting the network.

[RTI Issue ID ROUTING-1388]

15.4.5.2. [Critical] Potential out-of-bounds read in Routing Service when parsing invalid XML constant expression

An out-of-bounds read could have happened when processing XML containing a constant whose expression value was ill formed.

15.4.5.2.1. User Impact without Security

A vulnerability in Routing Service could have resulted in the following:

15.4.5.2.2. User Impact with Security

Similar to “User Impact without Security”; Security reduces the Attack Vector by protecting the network.

[RTI Issue ID ROUTING-1387]

15.4.5.3. [Critical] Potential stack buffer overflow in Routing Service when parsing malicious XML

Routing Service could have been affected by a vulnerability found in the Libxml2 third-party library. This issue has been resolved by upgrading to a newer version of the third-party library. See the third-party software upgrades in What’s New.

15.4.5.3.1. User Impact without Security

A vulnerability in Routing Service could have resulted in the following:

15.4.5.3.2. User Impact with Security

A vulnerability in Routing Service could have resulted in the following:

[RTI Issue ID ROUTING-1362]

15.4.5.4. [Critical] Potential stack buffer overflow in library rtixml2 when parsing malicious XML

RTI’s rtixml2 library could have been affected by a vulnerability found in the Libxml2 third-party library. This issue has been resolved by upgrading to a newer version of the third-party library. See Third-Party Software Changes in What’s New.

15.4.5.4.1. User Impact without Security

A vulnerability in the rtixml2 library could have resulted in the following:

15.4.5.4.2. User Impact with Security

A vulnerability in the rtixml2 library could have resulted in the following:

[RTI Issue ID ROUTING-1352]

15.4.5.5. [Critical] Potential unauthorized local file system read in Routing Service when parsing a malicious XML configuration document

Improper restriction of an XML external entity reference vulnerability in Routing Service when parsing a malicious XML configuration document could allow unauthorized local file system read access and Data Serialization External Entities Blowup.

15.4.5.5.1. User Impact without Security

A vulnerability in Routing Service while loading configurations via XML could have resulted in the following:

  • Unauthorized local file system read when parsing a malicious XML file.

  • Availability of the service affected (denial of service) when parsing a malicious XML file.

  • Exploitable by providing malicious XML code to the applications during startup.

  • Exploitable by providing malicious XML remotely through remote administration commands.

  • CVSS v3.1 Base Score: 9.1 CRITICAL

  • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

  • CVSS v4.0 Base Score: 8.8 HIGH

  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

15.4.5.5.2. User Impact with Security

A vulnerability in Routing Service while loading configurations via XML could have resulted in the following:

[RTI Issue ID ROUTING-1353]