Security update for openvswitch SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2255-1 Final 1 1 2023-05-19T13:22:35Z current 2023-05-19T13:22:35Z 2023-05-19T13:22:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openvswitch This update for openvswitch fixes the following issues: - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580). - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2255,SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-2255,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-2255,openSUSE-SLE-15.4-2023-2255 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232255-1/ Link for SUSE-SU-2023:2255-1 https://lists.suse.com/pipermail/sle-security-updates/2023-May/014930.html E-Mail link for SUSE-SU-2023:2255-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1206580 SUSE Bug 1206580 https://bugzilla.suse.com/1206581 SUSE Bug 1206581 https://www.suse.com/security/cve/CVE-2022-4337/ SUSE CVE CVE-2022-4337 page https://www.suse.com/security/cve/CVE-2022-4338/ SUSE CVE CVE-2022-4338 page SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 openSUSE Leap 15.4 libopenvswitch-2_11-0-2.11.5-150100.3.21.1 openvswitch-2.11.5-150100.3.21.1 openvswitch-devel-2.11.5-150100.3.21.1 openvswitch-doc-2.11.5-150100.3.21.1 openvswitch-ipsec-2.11.5-150100.3.21.1 openvswitch-ovn-central-2.11.5-150100.3.21.1 openvswitch-ovn-common-2.11.5-150100.3.21.1 openvswitch-ovn-docker-2.11.5-150100.3.21.1 openvswitch-ovn-host-2.11.5-150100.3.21.1 openvswitch-ovn-vtep-2.11.5-150100.3.21.1 openvswitch-pki-2.11.5-150100.3.21.1 openvswitch-test-2.11.5-150100.3.21.1 openvswitch-vtep-2.11.5-150100.3.21.1 python2-ovs-2.11.5-150100.3.21.1 python3-ovs-2.11.5-150100.3.21.1 libopenvswitch-2_11-0-2.11.5-150100.3.21.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libopenvswitch-2_11-0-2.11.5-150100.3.21.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 python2-ovs-2.11.5-150100.3.21.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 libopenvswitch-2_11-0-2.11.5-150100.3.21.1 as a component of openSUSE Leap 15.4 openvswitch-ovn-central-2.11.5-150100.3.21.1 as a component of openSUSE Leap 15.4 openvswitch-ovn-common-2.11.5-150100.3.21.1 as a component of openSUSE Leap 15.4 openvswitch-ovn-docker-2.11.5-150100.3.21.1 as a component of openSUSE Leap 15.4 openvswitch-ovn-host-2.11.5-150100.3.21.1 as a component of openSUSE Leap 15.4 openvswitch-ovn-vtep-2.11.5-150100.3.21.1 as a component of openSUSE Leap 15.4 An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. CVE-2022-4337 SUSE Linux Enterprise Module for Package Hub 15 SP4:libopenvswitch-2_11-0-2.11.5-150100.3.21.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libopenvswitch-2_11-0-2.11.5-150100.3.21.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python2-ovs-2.11.5-150100.3.21.1 openSUSE Leap 15.4:libopenvswitch-2_11-0-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-central-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-common-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-docker-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-host-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-vtep-2.11.5-150100.3.21.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232255-1/ https://www.suse.com/security/cve/CVE-2022-4337.html CVE-2022-4337 https://bugzilla.suse.com/1206581 SUSE Bug 1206581 An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. CVE-2022-4338 SUSE Linux Enterprise Module for Package Hub 15 SP4:libopenvswitch-2_11-0-2.11.5-150100.3.21.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libopenvswitch-2_11-0-2.11.5-150100.3.21.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:python2-ovs-2.11.5-150100.3.21.1 openSUSE Leap 15.4:libopenvswitch-2_11-0-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-central-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-common-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-docker-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-host-2.11.5-150100.3.21.1 openSUSE Leap 15.4:openvswitch-ovn-vtep-2.11.5-150100.3.21.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232255-1/ https://www.suse.com/security/cve/CVE-2022-4338.html CVE-2022-4338 https://bugzilla.suse.com/1206580 SUSE Bug 1206580