CVE-2017-9263 In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function ofp_print_role_status_message in l...
MediumCVSS 6.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function ofp_print_role_status_message in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openvswitch(Debian:12) | < 2.8.1+dfsg1-2 | 2.8.1+dfsg1-2 |
| debian/openvswitch(Debian:13) | < 2.8.1+dfsg1-2 | 2.8.1+dfsg1-2 |
| debian/openvswitch(Debian:14) | < 2.8.1+dfsg1-2 | 2.8.1+dfsg1-2 |
| openvswitch | = 2.7.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-9263 vendor-advisory
- RHSA-2017:2418 vendor-advisory
- RHSA-2017:2553 vendor-advisory
- RHSA-2017:2648 vendor-advisory
- RHSA-2017:2665 vendor-advisory
- RHSA-2017:2692 vendor-advisory
- RHSA-2017:2698 vendor-advisory
- RHSA-2017:2727 vendor-advisory
- mail.openvswitch.org mailing-list patch vendor-advisory
- bugs.debian.org issue-tracking