Security update for openvswitch SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2360-1 Final 1 1 2023-06-02T11:37:50Z current 2023-06-02T11:37:50Z 2023-06-02T11:37:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openvswitch This update for openvswitch fixes the following issues: - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580). - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581). - CVE-2022-32166: Fixed a out of bounds read in minimask_equal() (bsc#1203865). - CVE-2021-36980: Fixed a use-after-free issue during the decoding of a RAW_ENCAP action (bsc#1188524). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2360,SUSE-OpenStack-Cloud-9-2023-2360,SUSE-OpenStack-Cloud-Crowbar-9-2023-2360,SUSE-SLE-SAP-12-SP4-2023-2360,SUSE-SLE-SERVER-12-SP4-ESPOS-2023-2360,SUSE-SLE-SERVER-12-SP4-LTSS-2023-2360 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232360-1/ Link for SUSE-SU-2023:2360-1 https://lists.suse.com/pipermail/sle-security-updates/2023-June/015046.html E-Mail link for SUSE-SU-2023:2360-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188524 SUSE Bug 1188524 https://bugzilla.suse.com/1203865 SUSE Bug 1203865 https://bugzilla.suse.com/1206580 SUSE Bug 1206580 https://bugzilla.suse.com/1206581 SUSE Bug 1206581 https://www.suse.com/security/cve/CVE-2021-36980/ SUSE CVE CVE-2021-36980 page https://www.suse.com/security/cve/CVE-2022-32166/ SUSE CVE CVE-2022-32166 page https://www.suse.com/security/cve/CVE-2022-4337/ SUSE CVE CVE-2022-4337 page https://www.suse.com/security/cve/CVE-2022-4338/ SUSE CVE CVE-2022-4338 page SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libopenvswitch-2_8-0-2.8.10-4.33.1 openvswitch-2.8.10-4.33.1 openvswitch-devel-2.8.10-4.33.1 openvswitch-doc-2.8.10-4.33.1 openvswitch-ovn-central-2.8.10-4.33.1 openvswitch-ovn-common-2.8.10-4.33.1 openvswitch-ovn-docker-2.8.10-4.33.1 openvswitch-ovn-host-2.8.10-4.33.1 openvswitch-ovn-vtep-2.8.10-4.33.1 openvswitch-pki-2.8.10-4.33.1 openvswitch-test-2.8.10-4.33.1 openvswitch-vtep-2.8.10-4.33.1 python2-ovs-2.8.10-4.33.1 python3-ovs-2.8.10-4.33.1 libopenvswitch-2_8-0-2.8.10-4.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS openvswitch-2.8.10-4.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS libopenvswitch-2_8-0-2.8.10-4.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS openvswitch-2.8.10-4.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libopenvswitch-2_8-0-2.8.10-4.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 openvswitch-2.8.10-4.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libopenvswitch-2_8-0-2.8.10-4.33.1 as a component of SUSE OpenStack Cloud 9 openvswitch-2.8.10-4.33.1 as a component of SUSE OpenStack Cloud 9 libopenvswitch-2_8-0-2.8.10-4.33.1 as a component of SUSE OpenStack Cloud Crowbar 9 openvswitch-2.8.10-4.33.1 as a component of SUSE OpenStack Cloud Crowbar 9 Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. CVE-2021-36980 SUSE Linux Enterprise Server 12 SP4-ESPOS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-ESPOS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud 9:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:openvswitch-2.8.10-4.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232360-1/ https://www.suse.com/security/cve/CVE-2021-36980.html CVE-2021-36980 https://bugzilla.suse.com/1188524 SUSE Bug 1188524 https://bugzilla.suse.com/1196498 SUSE Bug 1196498 In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution. CVE-2022-32166 SUSE Linux Enterprise Server 12 SP4-ESPOS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-ESPOS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud 9:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:openvswitch-2.8.10-4.33.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232360-1/ https://www.suse.com/security/cve/CVE-2022-32166.html CVE-2022-32166 https://bugzilla.suse.com/1203865 SUSE Bug 1203865 An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. CVE-2022-4337 SUSE Linux Enterprise Server 12 SP4-ESPOS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-ESPOS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud 9:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:openvswitch-2.8.10-4.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232360-1/ https://www.suse.com/security/cve/CVE-2022-4337.html CVE-2022-4337 https://bugzilla.suse.com/1206581 SUSE Bug 1206581 An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. CVE-2022-4338 SUSE Linux Enterprise Server 12 SP4-ESPOS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-ESPOS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openvswitch-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud 9:openvswitch-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:libopenvswitch-2_8-0-2.8.10-4.33.1 SUSE OpenStack Cloud Crowbar 9:openvswitch-2.8.10-4.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232360-1/ https://www.suse.com/security/cve/CVE-2022-4338.html CVE-2022-4338 https://bugzilla.suse.com/1206580 SUSE Bug 1206580