CVE-2018-1078: Input Validation
It was found that all the flows, including active and inactive, in the config datastore are installed back in switch upon reconnection, as part of the node reconciliation process in OpenDayLight. This may lead to denial of service via table overflow or possibly circumventiagn of controller's control.
Other sources
OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or should expire shortly being re-installed and their timers reset resulting in traffic being allowed that should be expired.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1078?
CVE-2018-1078 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2018-1078?
To mitigate CVE-2018-1078, you should upgrade to the latest version of OpenDaylight that addresses this issue.
What versions of OpenDaylight are affected by CVE-2018-1078?
CVE-2018-1078 affects OpenDaylight versions up to and including carbon, as well as specific SP1, SP2, and SP3 releases.
What are the risks associated with CVE-2018-1078?
The risks associated with CVE-2018-1078 include table overflow and potential circumvention of the controller's control.
Is there a patch available for CVE-2018-1078?
Yes, patches to fix CVE-2018-1078 are available in the updated versions of OpenDaylight.