PT-2024-32291 · Opendaylight · Opendaylight Md-Sal

Published 2024-09-15 · Updated 2024-09-25 · CVE-2024-46942

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) versions through 13.0.1

Description A controller with a follower role can configure flow entries in an OpenDaylight clustering deployment.

Recommendations For OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) versions through 13.0.1, consider restricting the configuration capabilities of controllers with follower roles to prevent unauthorized flow entry configuration until a patch is available.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-46942

GHSA-HV38-H5PJ-C96J

Affected Products

Opendaylight Md-Sal

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-46942 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46942 · Vendor Advisory
• https://lf-opendaylight.atlassian.net/browse/MDSAL-869 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hv38-h5pj-c96j · Vendor Advisory
• https://github.com/opendaylight/mdsal · Note
• https://twitter.com/VulmonFeeds/status/1835476658456793273 · Twitter Post
• https://t.me/cvenotify/94922 · Telegram Post
• https://t.me/cvenotify/96029 · Telegram Post
• https://twitter.com/cracbot/status/1837008849955623165 · Twitter Post
• https://t.me/cvedetector/5701 · Telegram Post
• https://twitter.com/CVEnew/status/1835460895025119333 · Twitter Post
• https://docs.opendaylight.org/en/latest/release-notes/projects/mdsal.html · Note
• https://t.me/cvenotify/94687 · Telegram Post
• https://twitter.com/cracbot/status/1836646471413948617 · Twitter Post
• https://doi.org/10.48550/arXiv.2408.16940 · Note