PT-2020-9810 · Unknown · Open Network Operating System

Published 2020-02-20 · Updated 2020-02-25 · CVE-2019-16297

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Network Operating System (ONOS) version 1.14

Description An issue was discovered in the P4 tutorial application where the host event listener does not handle certain event types, including HOST MOVED, HOST REMOVED, and HOST UPDATED. This could potentially lead to the absence of intended code execution when used in combination with other applications.

Recommendations For Open Network Operating System (ONOS) version 1.14, consider modifying the host event listener in the P4 tutorial application to handle the HOST MOVED, HOST REMOVED, and HOST UPDATED event types until a patch is available.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2019-16297

Affected Products

Open Network Operating System

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-16297 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16297 · Vendor Advisory
• https://ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf · Note