PT-2018-2704 · Open Vswitch+3 · Openvswitch+3

Publicado 2018-08-15 · Atualizado 2021-08-04 · CVE-2018-17206

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open vSwitch (OvS) versions 2.7.x through 2.7.6

Description A buffer over-read issue exists in the decode bundle function inside lib/ofp-actions.c during BUNDLE action decoding. This issue can be exploited by a remote attacker to cause a denial of service.

Recommendations For Open vSwitch (OvS) versions 2.7.x through 2.7.6, consider disabling the decode bundle function as a temporary workaround until a patch is available. Restrict access to the lib/ofp-actions.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2018-2159

BDU:2019-01418

CVE-2018-17206

DLA-2571-1

OPENSUSE-SU-2018_4148-1

RHSA-2018:3500

RHSA-2019:0053

RHSA-2019:0081

SUSE-SU-2018:4128-1

USN-3873-1

Produtos afetados

Alt Linux

Openvswitch

Suse

Ubuntu

Referências · 27

• https://github.com/openvswitch/ovs/commit/9237a63c47bd314b807cda0bd2216264e82edbe8 · Correção
• https://osv.dev/vulnerability/SUSE-SU-2018:4128-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-2571-1 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:3500 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-17205 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-17204 · Nota
• https://access.redhat.com/errata/RHSA-2019:0081 · Aviso do Fabricante
• https://usn.ubuntu.com/3873-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3873-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-17205 · Nota
• https://access.redhat.com/errata/RHSA-2019:0053 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17206 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3873-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1104467 · Nota
• https://suse.com/security/cve/CVE-2018-17206 · Nota