CVE-2023-1668
High
Description
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
SeverityHigh
CVSS8.2
Exploit probability—
Product
Cloudbase Open Vswitch
PublishedApr 10, 2023
First seenApr 10, 2023
Weakness typeCWE-670CWE-670
How to fix
Update
- cloudbase open_vswitch2.13.11, 2.14.9, 2.15.8, 2.16.7, 2.17.6, 3.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudbase open_vswitch | 1.5.0 ≤ v < 2.13.11, 2.14.0 ≤ v < 2.14.9, 2.15.0 ≤ v < 2.15.8, 2.16.0 ≤ v < 2.16.7, 2.17.0 ≤ v < 2.17.6, 3.0.0 ≤ v < 3.0.4, 3.1.0 | 2.13.11, 2.14.9, 2.15.8, 2.16.7, 2.17.6, 3.0.4 |
| debian debian_linux | 11.0 | — |
| redhat openshift_container_platform | 4.0 | — |
| redhat openstack_platform | 16.1, 16.2, 17.0 | — |
| redhat virtualization | 4.0 | — |
| redhat fast_datapath | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.