CVE-2021-38445: OCI OpenDDS Secure Improper Handling of Length Parameter Inconsistency

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2021-38445.

Q: What is the severity of CVE-2021-38445?

The severity of CVE-2021-38445 is critical with a severity value of 9.8.

Q: What is the affected software for CVE-2021-38445?

The affected software for CVE-2021-38445 is OCI OpenDDS versions prior to 3.18.1.

Q: What is the description of CVE-2021-38445?

CVE-2021-38445 is a vulnerability in OCI OpenDDS versions prior to 3.18.1 that allows an attacker to remotely execute arbitrary code due to improper handling of a length parameter.

Q: Are there any references available for CVE-2021-38445?

Yes, there are references available for CVE-2021-38445. You can find them at the following links: [https://opendds.org/](https://opendds.org/) and [https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02](https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02).

Published May 5, 2022

Updated

OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code.

Affected Software

8 affected componentsFixes available

Objectcomputing Opendds<3.18.1

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Eclipse CycloneDDS<0.8.0

0.8.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing eProsima Fast DDS (#2269)<2.4.0

2.4.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing GurumNetworks GurumDDS

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Object Computing, Inc. (OCI) OpenDDS<3.18.1

3.18.1

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Real-Time Innovations (RTI) Connext DDS Professional and Connext DDS Secure: Versions 4.2x to 6.1.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing RTI Connext DDS Micro>=3.0.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing TwinOaks Computing CoreDX DDS<5.9.1

5.9.1

Remediation

Information

OCI recommends users update to version 3.18.1 of OpenDDS or later.

Event History

May 5, 2022

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-315-02

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2021-38445.

What is the severity of CVE-2021-38445?

The severity of CVE-2021-38445 is critical with a severity value of 9.8.

What is the affected software for CVE-2021-38445?