diff --git a/CRSA-2015-0007.yaml b/CRSA-2015-0007.yaml new file mode 100644 index 0000000..18431d2 --- /dev/null +++ b/CRSA-2015-0007.yaml @@ -0,0 +1,27 @@ +title: 'ONOS: denial-of-service (DoS) due to exception handling while deserializing jumbo frames' + +description: 'It was found that the packet deserializers in ONOS would throw exceptions when handling malformed, truncated or maliciously-crafted packets. The exceptions were not caught and handled, which would result in the relevant switch being disconnected because an exception occurred in an I/O thread. A remote unauthenticated attacker could use this flaw to perform a denial-of-service (DoS) attack by causing ONOS to disconnect switches.' + +references: + - https://wiki.onosproject.org/display/ONOS/Security+advisories + +affected-products: + + - product: ONOS + version: + - id: 1.3.0 + component: onos + issues: + - 143 + patches: + - https://gerrit.onosproject.org/#/c/6137/ + +vulnerabilities: + + - cve-id: CVE-2015-7516 + +reporters: + + - name: 'Kashyap Thimmaraju, Liron Schiff and Dr. Stefan Schmid' + reported: + - CVE-2015-7516