The remote host is affected by the vulnerability described in GLSA-202311-16 (Open vSwitch: Multiple Vulnerabilities)

  - A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to     be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-27827)

  - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing     can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel     to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-35498)

  - A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker     could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
    (CVE-2021-3905)

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

  - An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4337)

  - An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4338)

  - A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the     datapath flow without the action modifying the IP header. This issue results (for both kernel and     userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for     this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a !=     0 IP protocol that matches this dp flow. (CVE-2023-1668)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openvswitch package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0691 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * openvswitch: Out-of-Bounds Read in Organization Specific TLV (CVE-2022-4337)
    * openvswitch: Integer Underflow in Organization Specific TLV (CVE-2022-4338)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2250-2 advisory.

    - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580).
    - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2251-1 advisory.

    - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580).
    - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2259-1 advisory.

    - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580).
    - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581).
    - CVE-2022-32166: Fixed out of bounds read in minimask_equal() (bsc#1203865).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2274-1 advisory.

    - CVE-2023-1668: Fixed remote traffic denial of service via crafted packets with IP proto 0 (bsc#1210054).
    - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580).
    - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0689 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * openvswitch: Out-of-Bounds Read in Organization Specific TLV (CVE-2022-4337)
    * openvswitch: Integer Underflow in Organization Specific TLV (CVE-2022-4338)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5890-1 advisory.

    Qian Chen discovered that Open vSwitch incorrectly handled certain Organization Specific TLVs. A remote     attacker could use this issue to cause Open vSwitch to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of openvswitch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-4337 advisory.

  - An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
186285	GLSA-202311-16 : Open vSwitch: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/11/26	2023/11/26	critical
333670	Photon OS 5.0: Openvswitch PHSA-2023-5.0-91-0089	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	critical
171236	RHEL 9 : openvswitch2.17 (RHSA-2023:0691)	Nessus	Red Hat Local Security Checks	2023/2/9	2024/11/7	critical
178407	openSUSE 15: libopenvswitch-2_14-0 / libovn-20_06-0 / openvswitch / etc (SUSE-SU-2023:2250-2)	Nessus	SuSE Local Security Checks	2023/7/18	2026/6/25	critical
203462	Photon OS 4.0: Openvswitch PHSA-2023-4.0-0316	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/11/2	critical
176140	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2023:2251-1)	Nessus	SuSE Local Security Checks	2023/5/20	2026/6/25	critical
176224	SUSE SLES12: openvswitch / openvswitch-dpdk / openvswitch-dpdk-switch / etc (SUSE-SU-2023:2259-1)	Nessus	SuSE Local Security Checks	2023/5/23	2026/6/25	critical
176271	SUSE SLES15: libopenvswitch-2_13-0 / libovn-20_03-0 / openvswitch / etc (SUSE-SU-2023:2274-1)	Nessus	SuSE Local Security Checks	2023/5/24	2026/6/25	critical
204277	Photon OS 5.0: Openvswitch PHSA-2023-5.0-0089	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/10/14	critical
171234	RHEL 8 : openvswitch2.16 (RHSA-2023:0689)	Nessus	Red Hat Local Security Checks	2023/2/9	2024/11/7	critical
171941	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Open vSwitch vulnerabilities (USN-5890-1)	Nessus	Ubuntu Local Security Checks	2023/2/28	2024/8/27	critical
172885	CBL Mariner 2.0 Security Update: openvswitch (CVE-2022-4337)	Nessus	MarinerOS Local Security Checks	2023/3/20	2025/2/10	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical