CVE-2018-17204
Medium
Description
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Openvswitch
PublishedSep 19, 2018
First seenSep 19, 2018
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openvswitch openvswitch | 2.7.0 ≤ v ≤ 2.7.6 | — |
| redhat openstack | 10, 13 | — |
| canonical ubuntu_linux | 16.04, 18.04 | — |
| debian debian_linux | 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.