CVE-2023-5366

Name
CVE-2023-5366
Description
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://access.redhat.com/security/cve/CVE-2023-5366
MISC https://bugzilla.redhat.com/show_bug.cgi?id=2006347
secalert@redhat.com http://www.openwall.com/lists/oss-security/2024/02/08/4
secalert@redhat.com https://lists.debian.org/debian-lts-announce/2024/02/msg00004.html
secalert@redhat.com https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/
secalert@redhat.com https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* openvswitch >= None < 2023-02-28

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openvswitch edge-community 3.7.1-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 3.7.0-r1 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 3.7.0-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 3.6.1-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 3.3.7-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 3.3.6-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 3.3.5-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch edge-community 2.17.12-r0 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch edge-community 2.17.11-r0 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch edge-community 2.17.9-r1 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch edge-community 2.17.9-r0 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch edge-community 2.17.8-r0 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.17.6-r0 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.17.5-r0 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.13.6-r0 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.12.3-r4 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.12.3-r3 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.12.3-r2 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch edge-community 2.12.3-r0 None possibly vulnerable
openvswitch edge-community 2.12.2-r0 None possibly vulnerable
openvswitch edge-community 2.12.1-r0 None possibly vulnerable
openvswitch 3.24-community 3.7.1-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch 3.23-community 3.3.7-r0 Lindsay Zhou <i@lin.moe> fixed
openvswitch 3.22-community 2.17.12-r0 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch 3.22-community 2.17.11-r0 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch 3.22-community 2.17.9-r0 None fixed
openvswitch 3.22-community 2.17.8-r0 None possibly vulnerable
openvswitch 3.22-community 2.17.6-r0 None possibly vulnerable
openvswitch 3.22-community 2.17.5-r0 None possibly vulnerable
openvswitch 3.22-community 2.12.3-r2 None possibly vulnerable
openvswitch 3.22-community 2.12.3-r0 None possibly vulnerable
openvswitch 3.22-community 2.12.2-r0 None possibly vulnerable
openvswitch 3.22-community 2.12.1-r0 None possibly vulnerable
openvswitch 3.21-community 2.17.9-r0 None fixed
openvswitch 3.20-community 2.17.9-r1 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch 3.20-community 2.17.9-r0 None fixed
openvswitch 3.19-community 2.17.9-r0 Stuart Cardall <developer@it-offshore.co.uk> fixed
openvswitch 3.18-community 2.17.8-r0 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable
openvswitch 3.18-community 2.17.6-r0 Stuart Cardall <developer@it-offshore.co.uk> possibly vulnerable