RTI Connext Professional Exposure of Private Personal Information Vulnerability

A vulnerability in RTI Connext Professional Core Libraries allows unauthorized access to private personal information by sniffing network traffic. This issue affects Connext Professional versions 7.4.0 prior to 7.*, and 7.2.0 prior to 7.3.1.

Impact

Exploitation of this vulnerability could lead to unauthorized access to limited information about instances, such as the number of alive and disposed instances a DataWriter has, without accessing the serialized payloads of any samples. This vulnerability could also cause the Connext application to crash, potentially affecting the confidentiality and integrity of the application.

Remediation

Users can upgrade to RTI Connext Professional version 7.3.1 or later. For versions 7.2.0 prior to 7.3.1, a patch is available on the RTI Customer Portal. Users can also contact RTI Support to arrange for a patch on other versions and architectures.