CVE-2017-9265 In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in lib/ofp-util.c in the function ofputil_pull_ofp15_group_mod.
CriticalCVSS 9.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in lib/ofp-util.c in the function ofputil_pull_ofp15_group_mod.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openvswitch(Debian:12) | < 2.8.1+dfsg1-2 | 2.8.1+dfsg1-2 |
| debian/openvswitch(Debian:13) | < 2.8.1+dfsg1-2 | 2.8.1+dfsg1-2 |
| debian/openvswitch(Debian:14) | < 2.8.1+dfsg1-2 | 2.8.1+dfsg1-2 |
| openvswitch | = 2.7.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-9265 vendor-advisory
- RHSA-2017:2418 vendor-advisory
- RHSA-2017:2553 vendor-advisory
- RHSA-2017:2648 vendor-advisory
- RHSA-2017:2665 vendor-advisory
- RHSA-2017:2692 vendor-advisory
- RHSA-2017:2698 vendor-advisory
- RHSA-2017:2727 vendor-advisory
- mail.openvswitch.org mailing-list patch vendor-advisory
- bugs.debian.org issue-tracking