Red Hat Security Advisory 2021-1050-01 - Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Issues addressed include denial of service and memory leak vulnerabilities.
828795c93b0161574d19f6ec50e5a79355295024799c77249b9eeffe0c9f5f99
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: openvswitch2.11 security update
Advisory ID: RHSA-2021:1050-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1050
Issue date: 2021-03-31
CVE Names: CVE-2020-27827 CVE-2020-35498
====================================================================
1. Summary:
An update for openvswitch2.11 is now available in Red Hat Virtualization.
Red Hat Product Security has rated this update as having a security impact
of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts - ppc64le, x86_64
3. Description:
Open vSwitch provides standard network bridging functions and support for
the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
* openvswitch: limitation in the OVS packet parsing in userspace leads to
DoS (CVE-2020-35498)
* lldp/openvswitch: denial of service via externally triggered memory leak
(CVE-2020-27827)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/2974891
5. Bugs fixed (https://bugzilla.redhat.com/):
1908845 - CVE-2020-35498 openvswitch: limitation in the OVS packet parsing in userspace leads to DoS
1921438 - CVE-2020-27827 lldp/openvswitch: denial of service via externally triggered memory leak
6. Package List:
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts:
Source:
openvswitch2.11-2.11.3-86.el7fdp.src.rpm
ovn2.11-2.11.1-57.el7fdp.src.rpm
ppc64le:
openvswitch2.11-2.11.3-86.el7fdp.ppc64le.rpm
openvswitch2.11-debuginfo-2.11.3-86.el7fdp.ppc64le.rpm
openvswitch2.11-devel-2.11.3-86.el7fdp.ppc64le.rpm
ovn2.11-2.11.1-57.el7fdp.ppc64le.rpm
ovn2.11-debuginfo-2.11.1-57.el7fdp.ppc64le.rpm
ovn2.11-host-2.11.1-57.el7fdp.ppc64le.rpm
ovn2.11-vtep-2.11.1-57.el7fdp.ppc64le.rpm
python-openvswitch2.11-2.11.3-86.el7fdp.ppc64le.rpm
x86_64:
openvswitch2.11-2.11.3-86.el7fdp.x86_64.rpm
openvswitch2.11-debuginfo-2.11.3-86.el7fdp.x86_64.rpm
openvswitch2.11-devel-2.11.3-86.el7fdp.x86_64.rpm
ovn2.11-2.11.1-57.el7fdp.x86_64.rpm
ovn2.11-debuginfo-2.11.1-57.el7fdp.x86_64.rpm
ovn2.11-host-2.11.1-57.el7fdp.x86_64.rpm
ovn2.11-vtep-2.11.1-57.el7fdp.x86_64.rpm
python-openvswitch2.11-2.11.3-86.el7fdp.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-27827
https://access.redhat.com/security/cve/CVE-2020-35498
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYGRyQ9zjgjWX9erEAQhrShAAoeVmG1YdiiU+KFMdloJYVujUHAfasBEU
Lh4XW/2T4R+kLbrG+cNu6Whm5JrNMNHxcr7VCBzBxMH2BdmhbBc+UhxEVIAmq9Kd
BvOQykUW++052BkY4Iqm7q9viXkZNR4SK9fN2PKwK2yPezslta+AMQfnRhNzHU2a
zv2uMt+198ALo/NriH4E5MFX4L8J7gvI+w1M6WsTXET9PJ3okANav+3E6gtwgheq
gC0B3z7pzBDlSCIGXAi4lZjjtOd+jrZaxie6ltuQ0GPvEBLZXr+w8g9Q9SFhoBLE
nN2UuWzhAq66rFPCan5YHn41AUNtwvfu5MAWOwk3KDFXznS9exXsBBQjN25y4jcO
xl8cFSkJRghyJE1V5N2F52I9rTtqCysOyyLhoMWuNcYn7oU+rcQ/WAonrheYtZqk
t+iRwOf04o9Zt9ns9Q5iHG5aQwXq0rB+HAeGfb0+4izqUF43HWj2pyxtaPq2jQfa
iph0VN0x2M4ENXpjtO8vctu8Q1SKk0exiIou2d1EI0Dt4INZs67ewJyi1XoZP8Uu
xRUWSPDMaWHKYCXzBkVD6nJQNmLT2usb4rfc3SkqG1Wjr2ieiiQC6k1Z/wi+RKfW
lRK6WqHZTaAf0mG3QIjqmXa1IbF9CcGzoCtpfitPiWL0l2aewVSiDjXRsCVBorkX
O5fT6yRvUC8=XI93
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce