PT-2024-25939 · Unknown · Faucet Sdn Ryu

Erodedelk · Published 2024-05-04 · Updated 2024-07-03 · CVE-2024-34489

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Faucet SDN Ryu version 4.34

Description The issue allows attackers to cause a denial of service, resulting in an infinite loop, via a specific condition where length=0. This is related to the OFPHello function in the parser.py file.

Recommendations For Faucet SDN Ryu version 4.34, consider disabling the OFPHello function in parser.py to prevent the denial of service until a patch is available. Restrict access to the parser.py module to minimize the risk of exploitation. Avoid using the length=0 condition in the affected API endpoint until the issue is resolved.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2024-34489

GHSA-59P2-V62X-GXJ8

Affected Products

Faucet Sdn Ryu

References · 8

• https://github.com/faucetsdn/ryu/issues/195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34489 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34489 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59p2-v62x-gxj8 · Vendor Advisory
• https://github.com/faucetsdn/ryu · Note
• https://twitter.com/VulmonFeeds/status/1786994187042226673 · Twitter Post
• https://t.me/cvenotify/79131 · Telegram Post
• https://twitter.com/CVEnew/status/1787139425597640936 · Twitter Post