Product:

Openvswitch

(Openvswitch)
Repositories https://github.com/openvswitch/ovs
#Vulnerabilities 21
Date Id Summary Products Score Patch Annotated
2024-01-19 CVE-2024-22563 openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c. Openvswitch 7.5
2021-03-18 CVE-2020-27827 A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Fedora, Lldpd, Openvswitch, Enterprise_linux, Openshift_container_platform, Openstack, Virtualization, Simatic_hmi_unified_comfort_panels_firmware, Simatic_net_cp_1243\-1_firmware, Simatic_net_cp_1243\-8_irc_firmware, Simatic_net_cp_1542sp\-1_firmware, Simatic_net_cp_1542sp\-1_irc_firmware, Simatic_net_cp_1543\-1_firmware, Simatic_net_cp_1543sp\-1_firmware, Simatic_net_cp_1545\-1_firmware, Sinumerik_one_firmware, Tim_1531_irc_firmware 7.5
2021-02-11 CVE-2020-35498 A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Debian_linux, Fedora, Openvswitch 7.5
2021-07-20 CVE-2021-36980 Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. Openvswitch 5.5
2022-08-23 CVE-2021-3905 A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments. Ubuntu_linux, Fedora, Openvswitch, Enterprise_linux_fast_datapath 7.5
2023-01-10 CVE-2022-4337 An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. Debian_linux, Openvswitch 9.8
2023-01-10 CVE-2022-4338 An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. Debian_linux, Openvswitch 9.8
2022-09-08 CVE-2019-25076 The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, aka a Tuple Space Explosion (TSE) attack. Openvswitch 5.8
2022-08-29 CVE-2022-0669 A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service. Data_plane_development_kit, Openvswitch, Openshift_container_platform 6.5
2017-05-23 CVE-2017-9214 In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`. Debian_linux, Openvswitch, Openstack, Virtualization, Virtualization_manager 9.8