CVE-2017-1000361 OpenDaylight Controller DoS

What is CVE-2017-1000361?

CVE-2017-1000361 is a high-severity denial of service vulnerability in n/a, published on 24 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.

Which versions are affected by CVE-2017-1000361?

2 open source packages ship an affected version, including org.opendaylight.controller:releasepom. It affects 1 product.

Products include Opendaylight Opendaylight.

How do I fix CVE-2017-1000361?

No fix has been published for CVE-2017-1000361 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-1000361 being exploited?

There is no known exploitation of CVE-2017-1000361 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-1778 Opendaylight will authenticate any username and password combination Critical 9.8
• CVE-2017-1000411 Denial of service in n/a High 7.5
• CVE-2017-1000357 Denial of service in n/a High 7.5
• CVE-2014-5035 XML external entity in n/a Medium 6.8
• CVE-2017-1000358 Null dereference in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8p5x-w9cv-92hv.