PT-2024-32292 · Opendaylight · Opendaylight Authentication

Published 2024-09-15 · Updated 2024-10-24 · CVE-2024-46943

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenDaylight Authentication, Authorization and Accounting (AAA) versions through 0.19.3

Description An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA). A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.

Recommendations For OpenDaylight Authentication, Authorization and Accounting (AAA) versions through 0.19.3, consider restricting cluster join permissions to prevent rogue controllers from impersonating offline peers until a patch is available. As a temporary workaround, monitor cluster activity closely to detect and respond to potential impersonation attempts.

Fix

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-285

CWE-287

CWE-520

Related Identifiers

CVE-2024-46943

GHSA-46HR-3CQ3-MCGP

Affected Products

Opendaylight Authentication

References · 15

• https://lf-opendaylight.atlassian.net/browse/AAA-285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46943 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46943 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46hr-3cq3-mcgp · Vendor Advisory
• https://github.com/opendaylight/aaa · Note
• https://t.me/cvedetector/5702 · Telegram Post
• https://twitter.com/cracbot/status/1837008851511693683 · Twitter Post
• https://t.me/cvenotify/94688 · Telegram Post
• https://twitter.com/cracbot/status/1836646473146208381 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1835477414866043087 · Twitter Post
• https://docs.opendaylight.org/en/latest/release-notes/projects/aaa.html · Note
• https://twitter.com/CVEnew/status/1835460896254017823 · Twitter Post
• https://t.me/cvenotify/95473 · Telegram Post
• https://t.me/cvenotify/94923 · Telegram Post
• https://doi.org/10.48550/arXiv.2408.16940 · Note