Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-23932: Specially crafted RTPS message may cause an OpenDDS application to crash

CVE-2023-23932 · published 3 years ago

Summary

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issue has been patched in version 3.23.1.

What to do

Update objectcomputing opendds to version 3.23.1 or later.

Affected software

Vendor	Product	Affected versions
objectcomputing	opendds	< 3.23.1 `cpe:2.3:a:objectcomputing:opendds::::::::`

Original advisory text

Specially crafted RTPS message may cause an OpenDDS application to crash

References

https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.23.1 URL
https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-8wvq-25f5-f8h4 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23932... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-23932 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-248Uncaught Exception

Timeline

Published3 Feb 2023

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-23932 · NVD

CVE-2023-23932 · OSV

GHSA-8wvq-25f5-f8h4 · GHSA

Track software like this

Free during beta