CVE-2018-17204
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-17204
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-17204.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-17204
- Related
- Published
- 2018-09-19T16:29:00Z
- Modified
- 2024-10-12T03:16:49.713272Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parsegrouppropntrselectionmethod in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVSNOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.
- References
-
- https://access.redhat.com/errata/RHSA-2018:3500
- https://access.redhat.com/errata/RHSA-2019:0053
- https://access.redhat.com/errata/RHSA-2019:0081
- https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html
- https://github.com/openvswitch/ovs/commit/4af6da3b275b764b1afe194df6499b33d2bf4cde
- https://usn.ubuntu.com/3873-1/
- https://security-tracker.debian.org/tracker/CVE-2018-17204
Affected packages
Debian:11 / openvswitch
Package
- Name
- openvswitch
- Purl
- pkg:deb/debian/openvswitch?arch=source
Debian:12 / openvswitch
Package
- Name
- openvswitch
- Purl
- pkg:deb/debian/openvswitch?arch=source
Debian:13 / openvswitch
Package
- Name
- openvswitch
- Purl
- pkg:deb/debian/openvswitch?arch=source