What is GHSA-c6p7-vhw7-rc9w?

GHSA-c6p7-vhw7-rc9w is a security advisory published by GitHub Security Advisories with High severity. ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

Which CVE IDs does GHSA-c6p7-vhw7-rc9w cover?

GHSA-c6p7-vhw7-rc9w covers the following CVE IDs: CVE-2017-13763. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c6p7-vhw7-rc9w?

GHSA-c6p7-vhw7-rc9w has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c6p7-vhw7-rc9w?

GHSA-c6p7-vhw7-rc9w affects 1 product, including: maven/org.onosproject:onos-base:\u003e= 1.8.0, \u003c= 1.10.0.

GHSA-c6p7-vhw7-rc9wHighCVSS 7.5

ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

October 10, 2023

🔗 CVE IDs covered (1)

CVE-2017-13763 →

📋 Description

Open Network Operating System, ONOS, versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated because the NettyMessagingManager payload size is not limited. ONOS nodes timeout when trying to connect to the cluster in vm test cluster, leading to a potential denial of service.

🎯 Affected products1

maven/org.onosproject:onos-base:>= 1.8.0, <= 1.10.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2017-13763
https://gerrit.onosproject.org/#/c/13831/
https://gerrit.onosproject.org/#/c/14318/
https://github.com/opennetworkinglab/onos/commit/f7c7f6f229978fe4e78045069a4485504cc108c4
https://jira.onosproject.org/browse/ONOS-6401
https://github.com/advisories/GHSA-c6p7-vhw7-rc9w