PT-2017-10959 · Linux Foundation · Opendaylight Karaf

Published 2017-11-30 · Updated 2022-05-17 · CVE-2017-1000406

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenDaylight Karaf version 0.6.1-Carbon

Description The issue arises from the failure to clear the cache after a password change, allowing the old password to be used until the cache is manually cleared, for example, by restarting the system.

Recommendations For OpenDaylight Karaf version 0.6.1-Carbon, manually clear the Karaf cache, such as by restarting the system, after a password change to prevent the old password from being used.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2017-1000406

GHSA-4PX2-GQHV-MRC7

Affected Products

Opendaylight Karaf

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000406 · Security Note
• https://git.opendaylight.org/gerrit/#/q/topic:AAA-151 · Vendor Advisory
• https://jira.opendaylight.org/browse/AAA-151 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4px2-gqhv-mrc7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000406 · Vendor Advisory
• https://git.opendaylight.org/gerrit · Note
• http://seclists.org/oss-sec/2017/q4/320 · Note