PT-2020-9814 · Unknown · Open Network Operating System

Published 2020-02-20 · Updated 2020-02-25 · CVE-2019-16301

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Network Operating System (ONOS) version 1.14

Description An issue was discovered in the virtual tenant network application (org.onosproject.vtn) where the host event listener does not handle the HOST MOVED event type. This could lead to the absence of intended code execution when combined with other applications.

Recommendations For Open Network Operating System (ONOS) version 1.14, consider temporarily disabling the host event listener in the virtual tenant network application until a patch is available. Restrict access to the virtual tenant network application to minimize the risk of exploitation. Avoid using the HOST MOVED event type in the affected application until the issue is resolved.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2019-16301

Affected Products

Open Network Operating System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-16301 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16301 · Vendor Advisory
• https://t.me/cvenotify/1117 · Telegram Post
• https://ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf · Note