OSA-2019-012: SDC exposes JDWP outside of pod which allows for arbitrary code execution
SDC: Dublin and earlier
Radosław Żeszczuk from Samsung reported vulnerability in SDC. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod an unauthenticated attacker who already has access to pod to pod communication may execute arbitrary code inside this pod. All OOM ONAP setups which includes SDC are affected.
Radosław Żeszczuk from Samsung