SB2018112747 - Red Hat Virtualization update for Open vSwitch
Published: November 27, 2018 Updated: February 3, 2021
Security Bulletin ID
SB2018112747
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Assertion failure (CVE-ID: CVE-2018-17204)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists in parse_group_prop_ntr_selection_method in lib/ofp-util.c due to validation of the group type and command after the whole group mod has been decoded. A remote attacker can trigger an an assertion failure via OVS_NOT_REACHED when the OF1.5 decoder tries to use the type and command earlier, when it might still be invalid.
Remediation
Install update from vendor's website.