CVE-2025-29314

Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining SFC Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack...

org.opendaylight.groupbasedpolicy:features-groupbasedpolicy (0.7.4), org.opendaylight.groupbasedpolicy:odl-groupbasedpolicy-neutron-and-ofoverlay (>=0.5.0-carbon, <=0.7.4) +17 more potentially affected by CVE-2025-29314 via org.opendaylight.sfc:odl-sfc-openflow-renderer (>=0.5.0-carbon, <=0.10.4)

org.opendaylight.sfc:odl-sfc-openflow-renderer MAVEN version =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.6.0, =0.4.0-carbon, =0.5.0, =0.4.0-carbon, =0.5.0, =0.5.2 and more Source cves: CVE-2025-29314 Source advisory:...

org.opendaylight.groupbasedpolicy:features-groupbasedpolicy (0.7.4), org.opendaylight.groupbasedpolicy:odl-groupbasedpolicy-neutron-and-ofoverlay (>=0.5.0-carbon, <=0.7.4) +19 more potentially affected by CVE-2025-29314 via org.opendaylight.sfc:odl-sfc-ovs (>=0.5.0-carbon, <=0.10.4)

org.opendaylight.sfc:odl-sfc-ovs MAVEN version =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.6.0, =0.4.0-carbon, =0.5.0, =0.4.0-carbon, =0.4.4-carbon and more Source cves: CVE-2025-29314 Source advisory:...

CVE-2025-29314

Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining SFC Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack...

CVE-2025-29314

Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining SFC Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack...

CVE-2025-29314

The OpenDaylight Service Function Chaining (SFC) Subproject, specifically components odl-sfc-openflow-renderer and odl-sfc-ovs , is vulnerable to a Missing Encryption of Sensitive Data flaw. The root cause is the use of insecure Shiro cookie configurations, where _secureCookies=False and _httpOnl...