**Date:** 2019-05-28 **ID:** OSA-2019-015
**Title:** VNFSDK exposes JDWP port on localhost which allows to gain root privileges inside the container **CVE:** CVE-2019-12119 **Severity:** Moderate Affects ------- * VNFSDK: Dublin and earlier Description ----------- Radosław Żeszczuk from Samsung reported vulnerability in VNFSDK. By accessing port 8000 of demo-vnfsdk-vnfsdk on localhost an attacker who has access to this pod can gain root privileges. All OOM ONAP setups which includes VNFSDK are affected. Patches ------- No patch for this vulnerability has been proposed yet. Credits ------- * Radosław Żeszczuk from Samsung References ---------- * `OJSI-88 <https://jira.onap.org/browse/OJSI-88>`_ * `CVE-2019-12120 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12120>`_ -- Krzysztof Opasiak Samsung R&D Institute Poland Samsung Electronics -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#17271): https://lists.onap.org/g/onap-discuss/message/17271 Mute This Topic: https://lists.onap.org/mt/31822799/21656 Group Owner: [email protected] Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
