Homepage

Missing Authorization Affecting opendaylight package, versions *

Severity

 Recommended
medium

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.08% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Missing Authorization vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL7-OPENDAYLIGHT-5249040
  • published27 Mar 2023
  • disclosed18 Sept 2018
Report a new vulnerability Found a mistake?

Introduced: 18 Sep 2018

CVE-2018-11786  (opens in a new tab)
CWE-862  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:7 opendaylight.

NVD Description

Note: Versions mentioned in the description apply only to the upstream opendaylight package and not the opendaylight package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.