Design/Logic Flaw

Authentication Bypass by Spoofing in org.onosproject.acl access control and org.onosproject.mobility host mobility in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet injection. To exploit the vulnerability, an attacker sends a gratuitous ARP reply tha...

CVE-2019-16302

The CVE-2019-16302 entry affects Open Network Operating System (ONOS) 1.14, specifically the Ethernet VPN app (org.onosproject.evpnopenflow). The host event listener does not handle HOST_MOVED and HOST_UPDATED, which in combination with other applications could lead to the absence of intended cod...

CVE-2019-16301

CVE-2019-16301 affects ONOS 1.14 in the virtual tenant network (org.onosproject.vtn). The host event listener fails to handle HOST_MOVED, and when combined with other applications this could lead to absence of intended code execution. The provided connected documents confirm the issue and its con...

CVE-2019-16300

CVE-2019-16300 affects Open Network Operating System (ONOS) 1.14 in the acl application (org.onosproject.acl). The host event listener fails to handle HOST_REMOVED events, and in combination with other applications this could lead to absence of intended code execution. Documents consistently desc...

CVE-2019-16300

An issue was discovered in Open Network Operating System ONOS 1.14. In the access control application org.onosproject.acl, the host event listener does not handle the following event types: HOSTREMOVED. In combination with other applications, this could lead to the absence of intended code...

CVE-2019-16299

CVE-2019-16299 affects Open Network Operating System (ONOS) 1.14, specifically the mobility application’s host event listener (org.onosproject.mobility). The vulnerability arises because the listener does not handle HOST_ADDED, HOST_REMOVED, and HOST_UPDATED events, which in combination with othe...

CVE-2019-16298

ONOS 1.14 contains a bug in the Virtual BNG app’s host event listener (org.onosproject.virtualbng) where HOST_MOVED, HOST_REMOVED, and HOST_UPDATED events are not handled. In combination with other applications, this could lead to the absence of intended code execution. The vulnerability is docum...

CVE-2019-16297

ONOS 1.14’s P4 tutorial application (org.onosproject.p4tutorial) has a host event listener that fails to handle HOST_MOVED, HOST_REMOVED, and HOST_UPDATED. This gap can, in combination with other applications, permit unintended code execution. The issue is documented across multiple sources (ONOS...

CVE-2019-16297

An issue was discovered in Open Network Operating System ONOS 1.14. In the P4 tutorial application org.onosproject.p4tutorial, the host event listener does not handle the following event types: HOSTMOVED, HOSTREMOVED, HOSTUPDATED. In combination with other applications, this could lead to the...

CVE-2019-11189

The CVE describes an Authentication Bypass in ONOS v2.0 and earlier via data plane packet injection. A gratuitous ARP reply can trigger the host mobility application to remove existing access control flow denial rules, and the access control app does not re-install those deny rules, allowing bypa...

CVE-2019-11189

Authentication Bypass by Spoofing in org.onosproject.acl access control and org.onosproject.mobility host mobility in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet injection. To exploit the vulnerability, an attacker sends a gratuitous ARP reply tha...

Linux Foundation ONOS Remote Command Execution Vulnerability

Linux Foundation ONOS is a carrier-grade SDN network operating system. A remote command execution vulnerability exists in the runJavaCompiler method in YangLiveCompilerManager.java in Linux Foundation ONOS 1.15.0 and earlier. The vulnerability stems from improper input validation. An attacker can...

CVE-2019-1010234

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is:...

CVE-2019-1010234

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is:...

Input validation

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is:...

CVE-2019-1010234

The vulnerability CVE-2019-1010234 affects Linux Foundation ONOS 1.15.0 and earlier. It stems from improper input validation in the runJavaCompiler method of YangLiveCompilerManager.java, allowing an attacker to remotely execute commands by sending a malicious HTTP request to the controller. The ...

CVE-2019-1010234

The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is:...

CVE-2019-1010245

The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The...

CVE-2019-1010245

The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The...

Input validation

The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The...