CVE-2021-38443

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.6 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
icscertCNA
6.6 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
VendorProductVersion
eclipsecyclonedds
𝑥
< 0.8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cyclonedds
bullseye
no-dsa
bookworm
0.10.2-2
fixed
sid
0.10.5-1
fixed
trixie
0.10.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cyclonedds
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
Common Weakness Enumeration
References
https://projects.eclipse.org/projects/iot.cyclonedds
https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02
https://projects.eclipse.org/projects/iot.cyclonedds
https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02