OSA-2019-016: VNFSDK exposes JDWP port on localhost which allows to gain root privileges inside the container

Date: 2019-05-28

CVE: CVE-2019-12119

Severity: Moderate

Affects

VNFSDK: El Alto and earlier

Description

Radosław Żeszczuk from Samsung reported vulnerability in VNFSDK. By accessing port 8000 of demo-vnfsdk-vnfsdk on localhost an attacker who has access to this pod can gain root privileges. All OOM ONAP setups which includes VNFSDK are affected.

Patches

104335

Credits

Radosław Żeszczuk from Samsung

References