CVE-2023-23932 - Vulnerability Details - OpenCVE

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Objectcomputing	Opendds

Configuration 1 [-]

cpe:2.3:a:objectcomputing:opendds:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1
https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4

History

Mon, 10 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-02-03T20:08:31.160Z

Updated: 2025-03-10T21:16:50.373Z

Reserved: 2023-01-19T21:12:31.360Z

Link: CVE-2023-23932

Vulnrichment

Updated: 2024-08-02T10:42:27.098Z

NVD

Status : Modified

Published: 2023-02-03T21:15:11.267

Modified: 2024-11-21T07:47:07.697

Link: CVE-2023-23932

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23932", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-01-19T21:12:31.360Z", "datePublished": "2023-02-03T20:08:31.160Z", "dateUpdated": "2025-03-10T21:16:50.373Z"}, "containers": {"cna": {"title": "Specially crafted RTPS message may cause an OpenDDS application to crash", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4"}, {"name": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1"}], "affected": [{"vendor": "OpenDDS", "product": "OpenDDS", "versions": [{"version": "< 3.23.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-03T20:08:31.160Z"}, "descriptions": [{"lang": "en", "value": "OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1."}], "source": {"advisory": "GHSA-8wvq-25f5-f8h4", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:27.098Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4"}, {"name": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T20:59:11.115138Z", "id": "CVE-2023-23932", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:16:50.373Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4", "name": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1", "name": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:27.098Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23932", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T20:59:11.115138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T20:59:12.688Z"}}], "cna": {"title": "Specially crafted RTPS message may cause an OpenDDS application to crash", "source": {"advisory": "GHSA-8wvq-25f5-f8h4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OpenDDS", "product": "OpenDDS", "versions": [{"status": "affected", "version": "< 3.23.1"}]}], "references": [{"url": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4", "name": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1", "name": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-03T20:08:31.160Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23932", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:16:50.373Z", "dateReserved": "2023-01-19T21:12:31.360Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-02-03T20:08:31.160Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:objectcomputing:opendds:*:*:*:*:*:*:*:*", "matchCriteriaId": "415CD58E-32CD-4390-AAA1-F4FFC9A47333", "versionEndExcluding": "3.23.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1."}], "id": "CVE-2023-23932", "lastModified": "2024-11-21T07:47:07.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-03T21:15:11.267", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}