390 matches found
CVE-2022-29605
An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator...
CVE-2021-38364
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents...
CVE-2022-29607
An issue was discovered in ONOS 2.5.1. Modification of an existing intent to have the same source and destination shows the INSTALLED state without any flow rule. Improper handling of such an intent is misleading to a network operator...
CVE-2022-29606
ONOS 2.5.1 contains a vulnerability where an intent with large port numbers can enter a CORRUPT state, creating inconsistency between the declared intent and the resulting flow rules. Affected component is the intent handling/validation logic within the ONOS controller’s intent framework. The iss...
CVE-2022-29944
CVE-2022-29944 affects ONOS 2.5.1. The issue is an incorrect comparison of paths installed by intents, causing an existing intent to not redirect to a new path when a higher-priority intent shares that path. The public documents consistently describe this as the root cause but do not provide conc...
CVE-2021-38364
CVE-2021-38364 affects ONOS 2.5.1, where an incorrect comparison of flow rules installed by intents can let a remote attacker install or remove an intent and consequently modify or delete flow rules related to other intents. The consequence is unintended modification of flow state managed by the ...
CVE-2021-38363
An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent which causes an exception remains in pendingMap in memory forever. Deletion is possible neither by a user nor by the intermittent Intent Cleanup process...
CVE-2022-29608
CVE-2022-29608 affects ONOS 2.5.1. The issue arises when an intent uses a port that is an intermediate point in its path, which results in the installation of an invalid flow rule and can create a network loop. The available connected documents confirm the affected software and the underlying beh...
CVE-2022-29605
CVE-2022-29605 affects ONOS 2.5.1. The issue arises in the IntentManager , which attempts to install IPv6 flow rules for an intent into an OpenFlow 1.0 switch that does not support IPv6, due to improper handling of the capabilities mismatch. This discrepancy can mislead network operators about th...
CVE-2022-29608
An issue was discovered in ONOS 2.5.1. An intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop...
CVE-2022-29608
An issue was discovered in ONOS 2.5.1. An intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop...
CVE-2022-29944
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed...
GHSA-3XMP-JWRR-8F4R ONOS vulnerable to reflected cross-site scripting
A cross-site scripting XSS vulnerability in Open Network Operating System ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter of the API documentation dashboard under info contact URL...
ONOS vulnerable to reflected cross-site scripting
A cross-site scripting XSS vulnerability in Open Network Operating System ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter of the API documentation dashboard under info contact URL...
CVE-2023-24279
A cross-site scripting XSS vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard...
CVE-2023-24279
ONOS (Open Networking Foundation) is affected by a cross-site scripting (XSS) vulnerability in versions v1.9.0 through v2.7.0, exploitable via a crafted payload injected into the URL parameter of the API documentation dashboard. The concise root cause in the connected documents points to reflecti...
Open Networking Foundation ONOS 跨站脚本漏洞
Open Networking Foundation ONOS is an open source SDN controller from Open Networking Foundation open source. It is used to build next-generation SDN/NFV solutions. A security vulnerability exists in Open Networking Foundation ONOS versions v1.9.0 through v2.7.0, which stems from the presence of ...
GHSA-C6P7-VHW7-RC9W ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload
Open Network Operating System, ONOS, versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated because the NettyMessagingManager payload size is not limited. ONOS nodes timeout when trying to connect to the cluster in vm test cluster, leading to a potential denial of servic...
ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload
Open Network Operating System, ONOS, versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated because the NettyMessagingManager payload size is not limited. ONOS nodes timeout when trying to connect to the cluster in vm test cluster, leading to a potential denial of servic...
