Bug 13922

Summary:	[CVE 21] openvswitch 2.16.1 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	critical
Priority:	Highest	CC:	a.proklov, e.kosachev, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2019-25076, CVE-2021-3905, CVE-2023-5366,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-10-18 20:29:59 MSK

Please patch CVEs for package openvswitch version 2.16.1
  
INFO (CVEs are): openvswitch 2.16.1
 cves found
CVE-2019-25076
Desc: The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, aka a Tuple Space Explosion (TSE) attack.
Link: https://nvd.nist.gov/vuln/detail/CVE-2019-25076
Severity: MEDIUM
CVE-2021-3905
Desc: A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Link: https://nvd.nist.gov/vuln/detail/CVE-2021-3905
Severity: HIGH
CVE-2023-5366
Desc: A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-5366
Severity: MEDIUM

Comment 1 Vladimir Potapov 2023-10-20 18:06:03 MSK

*** Bug 13790 has been marked as a duplicate of this bug. ***

Comment 2 Aleksandr Proklov 2023-11-07 12:17:37 MSK

уязвимости лучше закрыть обновлением, изменение major либы не критично, эту либу только сам openvswitch использует.

openvswitch	2.17.8-1

https://abf.io/build_lists/4816564
https://abf.io/build_lists/4816565 x64
https://abf.io/build_lists/4816566
https://abf.io/build_lists/4816567
https://abf.io/build_lists/4816568

Comment 3 Yury 2023-11-07 12:46:21 MSK

secteam_verified

Comment 4 Dmitry Postnikov 2023-11-08 15:12:36 MSK

*****************************
Обновление отослано в Тестинг

кроме сборки e2kv4, у нее ошибка сборки

Comment 5 Vladimir Potapov 2023-11-09 10:30:56 MSK

openvswitch-2.17.8-1
https://abf.io/build_lists/4816564
https://abf.io/build_lists/4816565 x64
https://abf.io/build_lists/4816566
https://abf.io/build_lists/4816567
https://abf.io/build_lists/4816568
****************************** Advisory **************************
CVEs fix by update
******************************************************************
QA Verified