Requesting fix for CVE-2024-30916 in FastDDS 2.6.11

[srchaitu2008]

Hi eProsima team,

I would like to know the expected timeline for fix to the following CVEs in the Fast DDS 2.6.11 LTS release:

https://nvd.nist.gov/vuln/detail/CVE-2024-30916

This would help us in appropriate planning.

Thanks,
Ravi

[MiguelCompany]

We were never informed that a CVE was open for that issue. It was opened as a normal issue.
I see no security risk there, since the durability_service QoS is never used by Fast DDS.

As explained here the fix on 2.6.x would require breaking behavior (in particular, creating a DataWriter with default QoS would fail), so the backport was rejected.

Depending on the context, you could upgrade to a newer version of Fast DDS, since 2.6.x goes EOL in May 2027. I would at least try with 2.14.x