Vulnerabilities
===============

.. include:: ../../../../../connext_doc.1.0/srcDoc/release_notes/whats_fixed/vulnerability_reference.txt

.. Release Notes from this point.

:critical:`[Critical]` Potential Denial of Service in RTI Security Plugins for OpenSSL when loading Private Key
---------------------------------------------------------------------------------------------------------------
The *RTI Security Plugins* depended on OpenSSL 3.5.1, which is known to
be affected by the
`CVE-2026-22795 <https://nvd.nist.gov/vuln/detail/CVE-2026-22795>`__
publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest
stable version, 3.5.5.


.. rubric:: User Impact without Security

Not applicable (affects a security-specific product/feature only).


.. rubric:: User Impact with Security

-  Exploitable invalid or NULL pointer dereference in the *RTI Security
   Plugins* when loading a private key.

-  CVSS v3.1 Base Score: 5.5 Medium

-  CVSS v3.1 Vector:
   `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H <https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H>`__

-  CVSS 4.0 Base Score: 6.7 Medium

-  CVSS 4.0 Vector:
   `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N <https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N>`__


[RTI Issue ID SEC-2895]

:critical:`[Critical]` Potential stack buffer overflow in RTI Security Plugins for OpenSSL when loading Private Key
-------------------------------------------------------------------------------------------------------------------
The *RTI Security Plugins* depended on OpenSSL 3.5.1, which is known to
be affected by the
`CVE-2025-11187 <https://nvd.nist.gov/vuln/detail/CVE-2025-11187>`__
publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest
stable version, 3.5.5.


.. rubric:: User Impact without Security

Not applicable (affects a security-specific product/feature only).


.. rubric:: User Impact with Security

-  Exploitable stack buffer overflow in the *RTI Security Plugins* when
   loading a private key.

-  CVSS v3.1 Base Score: 6.1 Medium

-  CVSS v3.1 Vector:
   `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H <https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H>`__

-  CVSS 4.0 Base Score: 5.2 Medium

-  CVSS 4.0 Vector:
   `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N <https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N>`__


[RTI Issue ID SEC-2894]

:critical:`[Critical]` Potential Denial of Service in RTI Security Plugins for OpenSSL when parsing Permissions Document
------------------------------------------------------------------------------------------------------------------------
The *RTI Security Plugins* depended on OpenSSL 3.5.1, which is known to
be affected by the
`CVE-2026-22796 <https://nvd.nist.gov/vuln/detail/CVE-2026-22796>`__
publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest
stable version, 3.5.5.


.. rubric:: User Impact without Security

Not applicable (affects a security-specific product/feature only).


.. rubric:: User Impact with Security

-  Exploitable invalid or NULL pointer dereference in the *RTI Security
   Plugins* when parsing a Permissions Document.

-  CVSS v3.1 Base Score: 7.5 High

-  CVSS v3.1 Vector:
   `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H <https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H>`__

-  CVSS 4.0 Base Score: 8.7 High

-  CVSS 4.0 Vector:
   `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N <https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N>`__


[RTI Issue ID SEC-2893]

:critical:`[Critical]` Potential Denial of Service in RTI Security Plugins for OpenSSL when configuring client proxy
--------------------------------------------------------------------------------------------------------------------
The *RTI Security Plugins* depended on OpenSSL 3.5.1, which is known to
be affected by the
`CVE-2025-9232 <https://nvd.nist.gov/vuln/detail/CVE-2025-9232>`__
publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest
stable version, 3.5.5.


.. rubric:: User Impact without Security

Not applicable (affects a security-specific product/feature only).


.. rubric:: User Impact with Security

-  Exploitable Denial of Service in the *RTI Security Plugins* when the
   URL of the *DomainParticipant’s* OCSP responder has an IPv6 address
   and you configure a client proxy through the ``no_proxy`` and
   ``http_proxy`` (or ``https_proxy``) environment variables. Note that
   the *RTI Security Plugins* do not support configuring a client proxy
   for OCSP responders.

-  CVSS v3.1 Base Score: 5.9 Medium

-  CVSS v3.1 Vector:
   `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H <https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H>`__

-  CVSS 4.0 Base Score: 8.2 High

-  CVSS 4.0 Vector:
   `CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N <https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N>`__


[RTI Issue ID SEC-2823]


:critical:`[Critical]` A malicious authenticated participant could impersonate other participants
-------------------------------------------------------------------------------------------------
A malicious participant (A) could bypass RTPS origin authentication to
impersonate a participant (B). This allowed participant A to send
messages to participant B that appeared to be sent by participant B
itself. This exploit was only possible if participant B had already
successfully completed the authentication process with the participant
it intended to impersonate.


.. rubric:: User Impact without Security

Not applicable (affects a security-specific product/feature only).


.. rubric:: User Impact with Security

-  An authenticated remote attacker within the same domain may publish
   messages it is not authorized to publish; these messages may look as if
   they come from the local, legitimate victim *DomainParticipant*.

-  CVSS v3.1 Score: 6.5 MEDIUM

-  CVSS v3.1 Vector:
   `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N <https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N>`__

-  CVSS v4.0 Score: 6.0 MEDIUM

-  CVSS v4.0 Vector:
   `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N <https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N>`__


.. Vulnerabilities

[RTI Issue ID SEC-2881]

:critical:`[Critical]` Origin Authentication could be bypassed by crafting malicious RTPS message
-------------------------------------------------------------------------------------------------
When Origin Authentication Protection was enabled, a malicious insider
could bypass Origin Authentication Protection by crafting a malicious
RTPS message. The only GUID that Origin Authentication Protection
validates is the
`DDS_SampleInfo::publication_handle <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a2f113373fe7e8bc6b067833b06c3aef1>`__.
Other GUIDs, such as the
`DDS_SampleInfo::original_publication_virtual_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a12072c6ffa309d44e10201f9ec125ac8>`__
and the
`DDS_SampleInfo::source_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a02114b56a866fac45c24a2248671c7a0>`__
(which may appear in the inline QoS), are not validated by Origin
Authentication Protection. Depending on how the destination *DataReader*
interprets these other GUIDs, this behavior could allow the malicious
insider to send a message that appears to come from a different
*DataWriter*. If the *DataReader* has not set
``dds.data_reader.state.filter_redundant_samples`` to ``0``, then the
malicious insider could prevent the *DataReader* from receiving future
samples from a legitimate *DataWriter.*

This problem has been fixed by adding a new Permissions Document tag
called ``proxy``, and a new Governance Document tag called
``default_proxy_permissions``. When a *DataWriter* does not have
``proxy`` permissions, its samples are required to have
`original_publication_virtual_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a12072c6ffa309d44e10201f9ec125ac8>`__
and
`source_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a02114b56a866fac45c24a2248671c7a0>`__
equal to
`publication_handle <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a2f113373fe7e8bc6b067833b06c3aef1>`__.
The *DataReader* drops any samples that do not meet this requirement.
For more information on proxy permissions, see `DataWriters Acting as a
Proxy for other DataWriters, in the RTI Security Plugins User's Manual
7.7.0 <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/manuals/connext_dds_secure/users_manual/p2_core/access_control.html#datawriters-acting-as-a-proxy-for-other-datawriters>`__.

The issue also affected endpoint discovery. When an endpoint does not
have ``proxy`` permissions, its discovery messages are now required to have
a
`DDS_PublicationBuiltinTopicData::virtual_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1topic_1_1PublicationBuiltinTopicData.html#aa4ee09acef93f38e0f69fac273a5accf>`__
(or
`DDS_SubscriptionBuiltinTopicData::virtual_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1topic_1_1SubscriptionBuiltinTopicData.html#aa4ee09acef93f38e0f69fac273a5accf>`__)
equal to the
`source_guid <https://community.rti.com/static/documentation/connext-dds/7.7.0/doc/api/connext_dds/api_cpp2/classdds_1_1sub_1_1SampleInfo.html#a02114b56a866fac45c24a2248671c7a0>`__.


.. rubric:: User Impact without Security

Not applicable (affects a security-specific product/feature only).


.. rubric:: User Impact with Security

The impact on *Security Plugins* applications of using the previous
version was as follows:

-  Exploitable by crafting a malicious RTPS message.

-  CVSS v3.1 Base Score: 8.1 HIGH

-  CVSS v3.1 Vector:
   `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H <https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H>`__

-  CVSS v4.0 Base Score: 6.1 MEDIUM

-  CVSS v4.0 Vector:
   `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N <https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N>`__


.. Cryptography

[RTI Issue ID SEC-2791]



.. include:: ../../../../../connext_doc.1.0/srcDoc/release_notes/whats_fixed/disregard_if_7xbug.txt
