Vulnerability Description
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eprosima | Fast Dds | >= 2.6.0, < 2.6.5 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://github.com/eProsima/Fast-DDS/files/11117197/fastdds-assert.pcap.zipThird Party Advisory
- https://github.com/eProsima/Fast-DDS/issues/3422Third Party Advisory
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-x9pj-vrgf-f68fThird Party Advisory
- https://www.debian.org/security/2023/dsa-5481Third Party Advisory
- https://github.com/eProsima/Fast-DDS/files/11117197/fastdds-assert.pcap.zipThird Party Advisory
- https://github.com/eProsima/Fast-DDS/issues/3422Third Party Advisory
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-x9pj-vrgf-f68fThird Party Advisory
- https://www.debian.org/security/2023/dsa-5481Third Party Advisory
FAQ
What is CVE-2023-39948?
CVE-2023-39948 is a vulnerability with a CVSS score of 7.5 (HIGH). eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is no...
How severe is CVE-2023-39948?
CVE-2023-39948 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-39948?
Check the references section above for vendor advisories and patch information. Affected products include: Eprosima Fast Dds, Debian Debian Linux.