CVE-2021-38441: Eclipse CycloneDDS Write-what-where Condition
First published: Thu May 05 2022(Updated: )
Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse CycloneDDS | <0.8.0 | |
| <0.8.0 | 0.8.0 | |
| <2.4.0 | 2.4.0 | |
| <3.18.1 | 3.18.1 | |
| Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Real-Time Innovations (RTI) Connext DDS Professional and Connext DDS Secure: Versions 4.2x to 6.1.0 | ||
| Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing RTI Connext DDS Micro | >=3.0.0 | |
| Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing TwinOaks Computing CoreDX DDS | <5.9.1 | 5.9.1 |
Remedy
Eclipse recommends users apply the latest CycloneDDS patches. https://projects.eclipse.org/projects/iot.cyclonedds
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for Eclipse CycloneDDS?
The vulnerability ID for Eclipse CycloneDDS is CVE-2021-38441.
What is the severity of CVE-2021-38441?
The severity of CVE-2021-38441 is critical with a severity value of 9.8.
Which versions of Eclipse CycloneDDS are affected by CVE-2021-38441?
Versions of Eclipse CycloneDDS prior to 0.8.0 are affected by CVE-2021-38441.
What is the impact of CVE-2021-38441?
CVE-2021-38441 allows an attacker to write arbitrary values in the XML parser, which can lead to unauthorized modification of data.
How can I mitigate the vulnerability in Eclipse CycloneDDS?
To mitigate the vulnerability in Eclipse CycloneDDS, it is recommended to update to version 0.8.0 or later.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/softwarecombine
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/eclipse
- canonical/eclipse cyclonedds
- vendor/eclipse, eprosima, gurumnetworks, object computing, inc. (oci), real-time innovations (rti), twinoaks computing
- canonical/eclipse, eprosima, gurumnetworks, object computing, inc. (oci), real-time innovations (rti), twinoaks computing real-time innovations (rti) connext dds professional and connext dds secure: versions 4.2x to 6.1.0
- canonical/eclipse, eprosima, gurumnetworks, object computing, inc. (oci), real-time innovations (rti), twinoaks computing rti connext dds micro
- version/eclipse, eprosima, gurumnetworks, object computing, inc. (oci), real-time innovations (rti), twinoaks computing rti connext dds micro/3.0.0
- canonical/eclipse, eprosima, gurumnetworks, object computing, inc. (oci), real-time innovations (rti), twinoaks computing twinoaks computing coredx dds