CVE-2018-12691

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-12691

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12691.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-12691

Published

2018-07-05T18:29:00.360Z

Modified

2026-07-08T14:14:12.774467Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection.

References

Affected packages

Git / github.com/opennetworkinglab/onos

Affected ranges

Type

GIT

Repo

https://github.com/opennetworkinglab/onos

Events

Introduced

Last affected

d7b1a3c026176c322d08f9f41963e5decc61e66b

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.13.0"
        }
    ],
    "cpe": "cpe:2.3:a:onosproject:onos:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

1.*

1.0.0

1.1.0

1.1.0-rc2

1.10.0-rc1

1.11.0-b2

1.11.0-b3

1.11.0-b4

1.12.0-b1

1.12.0-b2

1.13.0

1.13.0-b5

1.13.0-b6

1.13.0-b7

1.13.0-b8

1.13.0-rc1

1.13.0-rc2

1.13.0-rc3

1.13.0-rc4

1.2.0

1.2.0-rc1

1.2.0-rc2

1.3.0-rc1

1.3.0-rc2

1.4.0

1.4.0-rc1

1.4.0-rc2

1.4.0-rc3

1.5.0

1.5.0-rc2

1.5.0-rc3

1.7.0-rc1

1.7.0-rc2

1.8.0-rc1

1.8.0-rc3

1.8.0-rc4

1.9.0-b1b

1.9.0-b3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12691.json"