MEDIUM4.3

GHSA-46hr-3cq3-mcgp

OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability

Details

An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue controller does not possess the complete cluster configuration information.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.opendaylight.aaa:aaa-artifacts

Introduced in: 0

No fixed version published yet for org.opendaylight.aaa:aaa-artifacts (maven). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-46943[ADVISORY]
https://docs.opendaylight.org/en/latest/release-notes/projects/aaa.html[WEB]
https://doi.org/10.48550/arXiv.2408.16940[WEB]
https://github.com/opendaylight/aaa[PACKAGE]
https://lf-opendaylight.atlassian.net/browse/AAA-285[WEB]