CVE-2021-38443: Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure
Published May 5, 2022
·Updated
Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.
Affected Software
8 affected componentsFixes available
Eclipse CycloneDDS<0.8.0
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Eclipse CycloneDDS<0.8.0
0.8.0
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing eProsima Fast DDS (#2269)<2.4.0
2.4.0
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing GurumNetworks GurumDDS
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Object Computing, Inc. (OCI) OpenDDS<3.18.1
3.18.1
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Real-Time Innovations (RTI) Connext DDS Professional and Connext DDS Secure: Versions 4.2x to 6.1.0
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing RTI Connext DDS Micro>=3.0.0
Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing TwinOaks Computing CoreDX DDS<5.9.1
5.9.1
Remediation
Information
Eclipse recommends users apply the latest CycloneDDS patches.
https://projects.eclipse.org/projects/iot.cyclonedds
Event History
May 5, 2022
CVE Published
via MITRE·03:16 PM
Data Sourced
via MITRE·03:16 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2021-38443?
CVE-2021-38443 is a vulnerability in Eclipse CycloneDDS versions prior to 0.8.0 that allows an attacker to write arbitrary values in the XML parser.
2
How severe is CVE-2021-38443?
CVE-2021-38443 has a severity level of critical with a CVSS score of 9.8.
3
Which software versions are affected by CVE-2021-38443?
Eclipse CycloneDDS versions up to but not including 0.8.0 are affected by CVE-2021-38443.
4
What is the Common Weakness Enumeration (CWE) for CVE-2021-38443?
The CWE for CVE-2021-38443 is 228.
5
Where can I find more information about CVE-2021-38443?
You can find more information about CVE-2021-38443 on the Eclipse CycloneDDS project page and the US-CERT advisory page.