PT-2022-10727 · Eclipse+1 · Eclipse Cyclonedds+1

Chizuru Toyama + 2 · Published 2022-05-05 · Updated 2022-05-13 · CVE-2021-38441

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse CycloneDDS versions prior to 0.8.0

Description The issue is related to a write-what-where condition that may allow an attacker to write arbitrary values in the XML parser. This could potentially be exploited by an attacker.

Recommendations For Eclipse CycloneDDS versions prior to 0.8.0, update to version 0.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the XML parser to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-123

Related Identifiers

CVE-2021-38441

Affected Products

Debian

Eclipse Cyclonedds

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-38441 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-38441 · Security Note
• https://ubuntu.com/security/CVE-2021-38441 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38441 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38441 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38441 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38441 · Vendor Advisory
• https://t.me/cvenotify/30167 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-315-02 · Note
• https://projects.eclipse.org/projects/iot.cyclonedds · Note