PT-2020-9813 · Unknown · Open Network Operating System

Published 2020-02-20 · Updated 2020-02-25 · CVE-2019-16300

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Network Operating System (ONOS) version 1.14

Description An issue in the access control application (org.onosproject.acl) of Open Network Operating System (ONOS) causes the host event listener to not handle the HOST REMOVED event type. This could lead to the absence of intended code execution when combined with other applications.

Recommendations For Open Network Operating System (ONOS) version 1.14, consider disabling the host event listener in the access control application as a temporary workaround until a patch is available. Restrict access to the org.onosproject.acl module to minimize the risk of exploitation. Avoid using the HOST REMOVED event type in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2019-16300

Affected Products

Open Network Operating System

References · 4

• https://osv.dev/vulnerability/CVE-2019-16300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16300 · Security Note
• https://t.me/cvenotify/1116 · Telegram Post
• https://ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf · Note