CVE-2020-35498

CVE-2020-35498

Name

CVE-2020-35498

Description

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
Issue Tracking	https://bugzilla.redhat.com/show_bug.cgi?id=1908845
Mailing List	https://www.openwall.com/lists/oss-security/2021/02/10/4
Third Party Advisory	https://www.debian.org/security/2021/dsa-4852
Mailing List	https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html
Third Party Advisory	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/

Type

URI

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1908845

Mailing List

https://www.openwall.com/lists/oss-security/2021/02/10/4

Third Party Advisory

https://www.debian.org/security/2021/dsa-4852

Mailing List

https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.5.0	< 2.5.12
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.6.0	< 2.6.10
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.7.0	< 2.7.13
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.8.0	< 2.8.11
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.9.0	< 2.9.9
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.10.0	< 2.10.7
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.11.0	< 2.11.6
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.12.0	< 2.12.3
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.13.0	< 2.13.3
`cpe:2.3:a:openvswitch:openvswitch::::::::`	openvswitch	>= 2.14.0	< 2.14.2

CPE URI

Source package

Min version

Max version