CVE-2023-39948: fallo de gravedad alta en eProsima Fast-DDS
Uncaught fastcdr exception (Unexpected CDR type received) crashing fastdds
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 1.0%
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
eProsima · Fast-DDSCVEs relacionadas — eProsima Fast-DDS
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2023-42459HIGHMalformed DATA submessage leads to bad-free error in Fast-DDSEPSS 1.0%CVE-2023-39947HIGHAnother heap overflow in push_back_helperEPSS 1.0%CVE-2024-28231CRITICALManipulated DATA Submessage causes a heap-buffer-overflow errorEPSS 0.9%CVE-2023-39945HIGHMalformed serialized data in a data submessage leads to unhandled exceptionEPSS 0.9%