PT-2019-14372 · Openstack · Openstack Os-Vif

James Denton · Publicado 2019-08-28 · Atualizado 2022-05-24 · CVE-2019-15753

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenStack os-vif versions 1.15.x through 1.15.1 OpenStack os-vif version 1.16.0

Description The issue affects deployments using the linuxbridge backend, where a hard-coded MAC aging time of 0 disables MAC learning. This forces obligatory Ethernet flooding of non-local destinations, impeding network performance and potentially allowing users to view the content of packets for instances belonging to other tenants on the same network. The problem occurs in the PyRoute2.add() function, located in the internal/command/ip/linux/impl pyroute2.py file.

Recommendations For OpenStack os-vif versions 1.15.x through 1.15.1, update to version 1.15.2 or later to resolve the issue. For OpenStack os-vif version 1.16.0, consider disabling the linuxbridge backend until a patch is available, or restrict access to the affected network to minimize the risk of exploitation.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2019-15753

GHSA-MCPW-CP35-P3H8

Produtos afetados

Openstack Os-Vif

Referências · 16

• https://github.com/openstack/os-vif · Nota
• https://github.com/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7 · Nota
• https://github.com/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aef · Nota
• https://review.opendev.org/678098 · Correção
• https://security.openstack.org/ossa/OSSA-2019-004.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mcpw-cp35-p3h8 · Aviso do Fabricante
• https://launchpad.net/bugs/1837252 · Nota
• https://ubuntu.com/security/CVE-2019-15753 · Aviso do Fabricante
• https://review.opendev.org/672834 · Correção
• http://openwall.com/lists/oss-security/2019/08/29/2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-15753 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15753 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-15753 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15753 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-15753 · Aviso do Fabricante