CVE-2023-1668

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-1668
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-1668.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-1668
Related
Published
2023-04-10T22:15:09Z
Modified
2024-10-12T10:28:25.931288Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

References

Affected packages

Debian:11 / openvswitch

Package

Name
openvswitch
Purl
pkg:deb/debian/openvswitch?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.15.0+ds1-2+deb11u4

Affected versions

2.*

2.15.0+ds1-2
2.15.0+ds1-2+deb11u1
2.15.0+ds1-2+deb11u2
2.15.0+ds1-2+deb11u3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / openvswitch

Package

Name
openvswitch
Purl
pkg:deb/debian/openvswitch?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / openvswitch

Package

Name
openvswitch
Purl
pkg:deb/debian/openvswitch?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.1.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/openvswitch/ovs

Affected ranges

Type
GIT
Repo
https://github.com/openvswitch/ovs
Events

Affected versions

v3.*

v3.0.0
v3.0.1
v3.0.2
v3.0.3