Multiple "expired" flows consume memory resources of CONFIG DS which leads to Controller shutdown.
Find out more about CVE-2017-1000411 from the MITRE CVE dictionary dictionary and NIST NVD.
OpenDaylight was released as a technical preview in Red Hat Openstack Platform versions 12 and under. Additionally, upstream have released an advisory outlining recommended actions, they will not be patching against this Denial of Service vector.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 5.7 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Attack Vector | Adjacent Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity Impact | None |
| Availability Impact | High |
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 9.0 | opendaylight | Will not fix |
| Red Hat OpenStack Platform 8.0 (Liberty) | opendaylight | Will not fix |
| Red Hat OpenStack Platform 12.0 | opendaylight | Will not fix |
| Red Hat OpenStack Platform 11.0 (Ocata) | opendaylight | Will not fix |
| Red Hat OpenStack Platform 10 | opendaylight | Will not fix |
Vulmon