CVE-2022-45932

A SQL injection issue was discovered in AAA in OpenDaylight ODL before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used...

CVE-2022-45931

Summary: CVE-2022-45931 affects the AAA component in OpenDaylight (ODL) prior to 0.16.5. The vulnerability resides in the deleteUser function of UserStore.java within aaa-idm-store-h2, exploitable via the /auth/v1/users/ API interface. The issue is a SQL injection that could allow a malicious use...

OpenDaylight SQL注入漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in versions of OpenDaylight ODL prior to 0.16.5, which originates in its aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java component in the /auth/ v1/user...

CVE-2022-45932

OpenDaylight (ODL) AAA component contains a SQL injection in the deleteRole path of RoleStore.deleteRole, exploitable via the /auth/v1/roles/ API. Affects ODL versions prior to 0.16.5. The vulnerability can allow a malicious user to execute arbitrary SQL against the backend database. Remediation:...

OpenFlow plugin for OpenDaylight allows spoofing the SDN topology

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."...

GHSA-49WF-927P-JPVJ OpenFlow plugin for OpenDaylight allows spoofing the SDN topology

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."...

GHSA-F2X4-547G-RP95 OpenFlow plugin for OpenDaylight LLDP Relay

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."...

OpenFlow plugin for OpenDaylight LLDP Relay

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."...

GHSA-QM24-4869-99PJ Opendaylight will authenticate any username and password combination

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination...

Opendaylight will authenticate any username and password combination

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination...

Password change doesn't result in Karaf clearing cache

OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared e.g. via restart...

GHSA-4PX2-GQHV-MRC7 Password change doesn't result in Karaf clearing cache

OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared e.g. via restart...

GHSA-8P5X-W9CV-92HV OpenDaylight Controller DoS

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0...

OpenDaylight Controller DoS

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0...

GHSA-GJQ3-997P-HG6F OpenDaylight NULL Pointer Dereference

StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0...

OpenDaylight NULL Pointer Dereference

StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0...

org.opendaylight.bier:bier-karaf (0.3.4), org.opendaylight.bier:features-bier (0.3.4) +10 more potentially affected by CVE-2015-7501 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic (4.01_1)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic MAVEN version 4.011 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic and may be impacted: -...

Insecure Default Configuration

tripleoheattemplates is vulnerable to insecure default configuration. The vulnerabilty exists due to the default configuration set for the OpenDayLight ODL admin users' credentials, allowing malicious users to gain unauthorized access...

Moderate: Red Hat Security Advisory: opendaylight security and bug fix update

An update for OpenDaylight is now available for Red Hat OpenStack Platform 13.0 Queens. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-tripleo-heat-templates hard-coded credentials vulnerability

openstack-tripleo-heat-templates is a template for deploying the OpenStack platform. A security vulnerability exists in versions prior to openstack-tripleo-heat-templates 8.0.2-40, where Opendaylight in RHOSP13 is configured with default credentials that can be easily guessed when deploying with...