CVE-2021-38443

EUVD-2021-24895
Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.6 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
icscertCNA
6.6 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
eclipsecyclonedds
𝑥
< 0.8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cyclonedds
bookworm
0.10.2-2
fixed
bullseye
no-dsa
sid
0.10.5-1
fixed
trixie
0.10.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cyclonedds
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
Common Weakness Enumeration
References
https://projects.eclipse.org/projects/iot.cyclonedds
https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02
https://projects.eclipse.org/projects/iot.cyclonedds
https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02