GitHub Advisoryadvisory · Maven

GHSA-c6p7-vhw7-rc9w ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

HIGH Published 2022-05-13 Modified 2023-10-10 Official page ↗
Aliases
CVE-2017-13763
Ecosystem
Maven
Packages
org.onosproject:onos-base
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2023-07-26

Affected packages

• Maven org.onosproject:onos-base: >= 1.8.0, < 1.11.0 → fixed in 1.11.0

Description

Open Network Operating System, ONOS, versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated because the NettyMessagingManager payload size is not limited. ONOS nodes timeout when trying to connect to the cluster in vm test cluster, leading to a potential denial of service.

Related

Alias · CVE (1)

  • CVE-2017-13763 ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References