Vulnerabilities
===============

.. Release Notes from this point.

:critical:`[Critical]` Heap buffer overflow while creating a DomainParticipant that uses a malformed Identity Certificate
-------------------------------------------------------------------------------------------------------------------------
The *Security Plugins* were affected by a heap buffer overflow vulnerability
that occurred while creating a *DomainParticipant* that used a malformed
Identity Certificate.

User Impact without Security
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
None.

User Impact with Security
^^^^^^^^^^^^^^^^^^^^^^^^^

The impact on *Security Plugins* applications of using the previous
version was as follows:

-   Exploitable by overwriting the Identity Certificate on the file
    system with a malicious Identity Certificate that does not even need
    to be properly signed by the Identity CA.

-   The application could have experienced a heap buffer overwrite
    during creation of a new *DomainParticipant* that attempted to use
    the malicious Identity Certificate, impacting the integrity and
    availability of the application.

-   This problem was much easier to exploit on a 32-bit architecture. On
    a 64-bit architecture, this problem affected only the *Security
    Plugins* for OpenSSL, not wolfSSL.

-   The problem was only exploitable if the
    `authentication.propagate_simplified_identity_certificate` property
    was unset or set to `TRUE`.

-   CVSS Base Score: 7.1 HIGH

-   CVSS v3.1 Vector: 
    `AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H <https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H>`__

[RTI Issue ID SEC-2444]
