PT-2020-9815 · Unknown · Open Network Operating System

Published 2020-02-20 · Updated 2020-02-25 · CVE-2019-16302

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Network Operating System (ONOS) version 1.14

Description An issue was discovered in the Ethernet VPN application, specifically in the host event listener, which does not handle the event types HOST MOVED and HOST UPDATED. This could lead to the absence of intended code execution when combined with other applications.

Recommendations For Open Network Operating System (ONOS) version 1.14, consider modifying the host event listener in the Ethernet VPN application to handle the HOST MOVED and HOST UPDATED event types until a patch is available. As a temporary workaround, restrict the use of the Ethernet VPN application in combination with other applications to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2019-16302

Affected Products

Open Network Operating System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-16302 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16302 · Vendor Advisory
• https://ndss-symposium.org/wp-content/uploads/2020/02/24080.pdf · Note
• https://t.me/cvenotify/1118 · Telegram Post