Insufficient Verification of Data Authenticity Affecting fastdds package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-FASTDDS-8719787
- published13 Feb 2025
- disclosed11 Feb 2025
Introduced: 11 Feb 2025
NewCVE-2025-24807 (opens in a new tab)How to fix?
There is no fixed version for Debian:unstable fastdds.
NVD Description
Note: Versions mentioned in the description apply only to the upstream fastdds package and not the fastdds package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing governance/permissions from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.
References
- https://security-tracker.debian.org/tracker/CVE-2025-24807
- https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/accesscontrol/Permissions.cpp#L390-L396
- https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/accesscontrol/Permissions.cpp#L412
- https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/authentication/PKIDH.cpp#L241
- https://github.com/eProsima/Fast-DDS/pull/5530
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-w33g-jmm2-8983
- https://www.omg.org/spec/DDS-SECURITY/1.1/PDF