ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

ALTO 7.5CVE-2017-13763 · GHSA-c6p7-vhw7-rc9w · Published 30/08/2017 · updated 17/06/2026

In breve

CVE-2017-13763 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.onosproject:onos-base, onos (onosproject).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.5% delle vulnerabilità.
Correzione: aggiornare a 1.11.0 o successiva.

Package	Affected versions	Patched versions
org.onosproject:onos-base Maven	`≥ 1.8.0, < 1.11.0`	`1.11.0`
onos onosproject	`= 1.10.0= 1.8.0= 1.9.0`	No fix yet

Description

Open Network Operating System, ONOS, versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated because the NettyMessagingManager payload size is not limited. ONOS nodes timeout when trying to connect to the cluster in vm test cluster, leading to a potential denial of service.

NVD description

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.

References

nvd.nist.gov/vuln/detail/CVE-2017-13763 · ADVISORY
opennetworkinglab/onos commit f7c7f6f · WEB
gerrit.onosproject.org · WEB
gerrit.onosproject.org · WEB
opennetworkinglab/onos · PACKAGE
jira.onosproject.org/browse/ONOS-6401 · WEB
gerrit.onosproject.org · Issue Tracking
gerrit.onosproject.org · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free