OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or should expire shortly being re-installed and their timers reset resulting in traffic being allowed that should be expired.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openflow | Opendaylight | * | carbon (including) |
| Openflow | Opendaylight | sp1 (including) | sp1 (including) |
| Openflow | Opendaylight | sp2 (including) | sp2 (including) |
| Openflow | Opendaylight | sp3 (including) | sp3 (including) |