5.3

CVE-2023-3153

Service monitor mac flow is not rate limited

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ovn ≫ Open Virtual Network Version < 22.03.3
Ovn ≫ Open Virtual Network Version >= 22.03.4 < 22.09.2
Ovn ≫ Open Virtual Network Version >= 22.09.3 < 22.12.1
Ovn ≫ Open Virtual Network Version >= 22.12.2 < 23.03.1
Ovn ≫ Open Virtual Network Version >= 23.03.2 < 23.06.1
Redhat ≫ Fast Datapath Version-
   Redhat ≫ Enterprise Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.99% 0.582
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
secalert@redhat.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://access.redhat.com/security/cve/CVE-2023-3153
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2213279
Issue Tracking
https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd
Patch
https://github.com/ovn-org/ovn/issues/198
Issue Tracking
https://mail.openvswitch.org/pipermail/ovs-announce/2023-August/000327.html
Patch
Mitigation
https://mail.openvswitch.org/pipermail/ovs-dev/2023-August/407553.html
Patch