CVE-2018-1132: SQL Injection
A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) without authenticating to the controller or SDNInterfaceapp. SDNInterface has been deprecated in OpenDayLight since it was last used in the final Carbon series release. In addition to the component not being included in OpenDayLight in newer releases, the SDNInterface component is not packaged in the opendaylight package included in RHEL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1132?
CVE-2018-1132 is considered a high severity vulnerability due to its potential for SQL injection without authentication.
How do I fix CVE-2018-1132?
To fix CVE-2018-1132, it is recommended to upgrade to a version of OpenDaylight that does not include the vulnerable SDNInterface app.
Which versions of OpenDaylight are affected by CVE-2018-1132?
CVE-2018-1132 affects all versions of OpenDaylight's SDNInterfaceapp up to and including carbon-sr4.
What type of attack does CVE-2018-1132 facilitate?
CVE-2018-1132 facilitates SQL injection attacks against the SQLite database of the SDNInterfaceapp.
Is the SDNInterfaceapp still in use after CVE-2018-1132?
The SDNInterfaceapp has been deprecated in OpenDaylight since the final Carbon series release and is no longer in use.