org.onosproject:onos-api@2.5.7-rc1 vulnerabilities
latest version
2.7.0
latest non vulnerable version
first published
10 years ago
latest version published
3 years ago
licenses detected
- [1.0.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.onosproject:onos-api package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization via uploading a crafted YAML file. How to fix Cross-site Scripting (XSS)? There is no fixed version for | [1.9.0,) |
Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions such that there is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed. How to fix Improper Handling of Exceptional Conditions? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions such that there is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed. How to fix Improper Handling of Exceptional Conditions? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions such that modification of an existing intent to have the same source and destination shows the INSTALLED state without any flow rule. Improper handling of such an intent is misleading to a network operator. How to fix Improper Handling of Exceptional Conditions? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Access Control Bypass such that to attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller. How to fix Access Control Bypass? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Denial of Service (DoS) such that an intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling of such port numbers causes inconsistency between intent and flow rules in the network. How to fix Denial of Service (DoS)? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Denial of Service (DoS) such that the purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In combination with other applications, it could lead to a failure of network management. How to fix Denial of Service (DoS)? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions such that an intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading to a network operator. How to fix Improper Handling of Exceptional Conditions? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Denial of Service (DoS) such that an intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop. How to fix Denial of Service (DoS)? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity such that an intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. This causes inconsistency between intent and flow rules in the network. How to fix Improper Handling of Case Sensitivity? There is no fixed version for | [2.5.1,) |
Affected versions of this package are vulnerable to Access Control Bypass such that there is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents. How to fix Access Control Bypass? There is no fixed version for | [2.5.1,) |