Critical · 9.8 CVE-2015-1778 EUVD-2015-1905GHSA-qm24-4869-99pj

Opendaylight will authenticate any username and password combination

Published Jun 27, 2017 · Updated Aug 6, 2024 · Assigned by redhat

Package: org.opendaylight.odlparent:opendaylight-karaf-resources Ecosystem: Maven

Description

The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.opendaylight.odlparent:opendaylight-karaf-resources	< 0.2.3-Helium-SR3	0.2.3-Helium-SR3	GHSA-qm24-4869-99pj

References

[oss-security] 20150320 OpenDaylight security advisory: CVE-2015-1778 authentication bypass, CVE-2015-1611 CVE-2015-1612 topology spoofing via LLDP mailing-list
73255 vdb-entry
https://wiki.opendaylight.org/view/Security_Advisories
https://cloudrouter.org/security/