Product:

Openvswitch

(Openvswitch)
Repositories https://github.com/openvswitch/ovs
#Vulnerabilities 21
Date Id Summary Products Score Patch Annotated
2021-02-11 CVE-2020-35498 A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Debian_linux, Fedora, Openvswitch 7.5
2021-03-18 CVE-2020-27827 A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Fedora, Lldpd, Openvswitch, Enterprise_linux, Openshift_container_platform, Openstack, Virtualization, Simatic_hmi_unified_comfort_panels_firmware, Simatic_net_cp_1243\-1_firmware, Simatic_net_cp_1243\-8_irc_firmware, Simatic_net_cp_1542sp\-1_firmware, Simatic_net_cp_1542sp\-1_irc_firmware, Simatic_net_cp_1543\-1_firmware, Simatic_net_cp_1543sp\-1_firmware, Simatic_net_cp_1545\-1_firmware, Sinumerik_one_firmware, Tim_1531_irc_firmware 7.5
2021-07-20 CVE-2021-36980 Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. Openvswitch 5.5
2022-08-23 CVE-2021-3905 A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments. Ubuntu_linux, Fedora, Openvswitch, Enterprise_linux_fast_datapath 7.5
2022-08-29 CVE-2022-0669 A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service. Data_plane_development_kit, Openvswitch, Openshift_container_platform 6.5
2023-01-10 CVE-2022-4337 An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. Debian_linux, Openvswitch 9.8
2023-01-10 CVE-2022-4338 An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. Debian_linux, Openvswitch 9.8
2023-10-06 CVE-2023-5366 A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses. Openvswitch, Enterprise_linux, Fast_datapath, Openshift_container_platform, Virtualization 5.5
2024-01-19 CVE-2024-22563 openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c. Openvswitch 7.5
2022-09-08 CVE-2019-25076 The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, aka a Tuple Space Explosion (TSE) attack. Openvswitch 5.8