PT-2020-9812 · Unknown · Open Network Operating System

Published 2020-02-20 · Updated 2020-02-25 · CVE-2019-16299

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Network Operating System (ONOS) version 1.14

Description An issue was discovered in the mobility application (org.onosproject.mobility) where the host event listener does not handle the event types: HOST ADDED, HOST REMOVED, HOST UPDATED. This could lead to the absence of intended code execution when combined with other applications.

Recommendations For Open Network Operating System (ONOS) version 1.14, consider modifying the host event listener in the mobility application to handle the missing event types (HOST ADDED, HOST REMOVED, HOST UPDATED) to prevent unintended code execution absence. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2019-16299

Affected Products

Open Network Operating System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-16299 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16299 · Vendor Advisory
• https://ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf · Note
• https://t.me/cvenotify/1115 · Telegram Post