GHSA-c6p7-vhw7-rc9w

ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

Source: GitHub Advisory Database (reviewed) High CVE-2017-13763

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.onosproject:onos-base	>= 1.8.0, < 1.11.0	1.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

Open Network Operating System, ONOS, versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated because the NettyMessagingManager payload size is not limited. ONOS nodes timeout when trying to connect to the cluster in vm test cluster, leading to a potential denial of service.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-13763 advisory
https://github.com/opennetworkinglab/onos/commit/f7c7f6f229978fe4e78045069a4485504cc108c4 web
https://gerrit.onosproject.org/#/c/13831 web
https://gerrit.onosproject.org/#/c/14318 web
https://github.com/opennetworkinglab/onos package
https://jira.onosproject.org/browse/ONOS-6401 web