8.2

CVE-2023-1668

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cloudbase ≫ Open Vswitch Version >= 1.5.0 < 2.13.11
Cloudbase ≫ Open Vswitch Version >= 2.14.0 < 2.14.9
Cloudbase ≫ Open Vswitch Version >= 2.15.0 < 2.15.8
Cloudbase ≫ Open Vswitch Version >= 2.16.0 < 2.16.7
Cloudbase ≫ Open Vswitch Version >= 2.17.0 < 2.17.6
Cloudbase ≫ Open Vswitch Version >= 3.0.0 < 3.0.4
Cloudbase ≫ Open Vswitch Version 3.1.0
Debian ≫ Debian Linux Version 11.0
Redhat ≫ Openstack Platform Version 16.1
Redhat ≫ Openstack Platform Version 16.2
Redhat ≫ Openstack Platform Version 17.0
Redhat ≫ Virtualization Version 4.0
Redhat ≫ Fast Datapath Version -
   Redhat ≫ Enterprise Linux Version 7.0
   Redhat ≫ Enterprise Linux Version 8.0 SwEdition -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.22% 0.647
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.2 3.9 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CISA-ADP 8.2 3.9 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-670 Always-Incorrect Control Flow Implementation

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

https://security.gentoo.org/glsa/202311-16
https://bugzilla.redhat.com/show_bug.cgi?id=2137666
Third Party Advisory
Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/
https://www.debian.org/security/2023/dsa-5387
Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/04/06/1
Patch
Mailing List
Mitigation