CVE-2021-38447: OCI OpenDDS Secure Amplification

Q: What is CVE-2021-38447?

CVE-2021-38447 is a vulnerability in OCI OpenDDS versions prior to 3.18.1 that allows an attacker to flood target devices with specially crafted packets, potentially causing a denial-of-service condition.

Q: How does CVE-2021-38447 impact the affected software?

CVE-2021-38447 allows an attacker to send specially crafted packets to flood target devices, potentially resulting in a denial-of-service condition.

Q: What is the severity of CVE-2021-38447?

CVE-2021-38447 has a severity rating of high, with a score of 7.5.

Q: How can I fix CVE-2021-38447 vulnerability?

To fix the CVE-2021-38447 vulnerability, it is recommended to upgrade to OCI OpenDDS version 3.18.1 or later.

Q: Where can I find more information about CVE-2021-38447?

More information about CVE-2021-38447 can be found at the official OpenDDS website (https://opendds.org/) and the CISA website (https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02).

Published May 5, 2022

Updated

OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition.

Affected Software

8 affected componentsFixes available

Objectcomputing Opendds<3.18.1

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Eclipse CycloneDDS<0.8.0

0.8.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing eProsima Fast DDS (#2269)<2.4.0

2.4.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing GurumNetworks GurumDDS

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Object Computing, Inc. (OCI) OpenDDS<3.18.1

3.18.1

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing Real-Time Innovations (RTI) Connext DDS Professional and Connext DDS Secure: Versions 4.2x to 6.1.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing RTI Connext DDS Micro>=3.0.0

Eclipse, eProsima, GurumNetworks, Object Computing, Inc. (OCI), Real-Time Innovations (RTI), TwinOaks Computing TwinOaks Computing CoreDX DDS<5.9.1

5.9.1

Remediation

Information

OCI recommends users update to version 3.18.1 of OpenDDS or later.

Event History

May 5, 2022

CVE Published

via MITRE·03:18 PM

Data Sourced

via MITRE·03:18 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-315-02

Frequently Asked Questions

What is CVE-2021-38447?

CVE-2021-38447 is a vulnerability in OCI OpenDDS versions prior to 3.18.1 that allows an attacker to flood target devices with specially crafted packets, potentially causing a denial-of-service condition.

How does CVE-2021-38447 impact the affected software?

CVE-2021-38447 allows an attacker to send specially crafted packets to flood target devices, potentially resulting in a denial-of-service condition.

What is the severity of CVE-2021-38447?