drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in openvswitch
Name: |
Mehrere Probleme in openvswitch |
|
ID: |
SUSE-SU-2023:2360-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 9, SUSE Linux Enterprise Server 12 SP4, SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4, SUSE Linux Enterprise High Performance Computing 12 SP4, SUSE Linux Enterprise Server for SAP Applications 12 SP4, SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 |
|
Datum: |
Fr, 2. Juni 2023, 23:48 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4338
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36980
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32166
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4337 |
|
Applikationen: |
Open vSwitch |
|
Originalnachricht |
--===============5082277004251994737== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
# Security update for openvswitch
Announcement ID: SUSE-SU-2023:2360-1 Rating: important References:
* #1188524 * #1203865 * #1206580 * #1206581
Cross-References:
* CVE-2021-36980 * CVE-2022-32166 * CVE-2022-4337 * CVE-2022-4338
CVSS scores:
* CVE-2021-36980 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2021-36980 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2022-32166 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H * CVE-2022-32166 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-4337 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2022-4337 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2022-4338 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2022-4338 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP4 * SUSE Linux Enterprise Server 12 SP4 * SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 * SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 * SUSE OpenStack Cloud 9 * SUSE OpenStack Cloud Crowbar 9
An update that solves four vulnerabilities can now be installed.
## Description:
This update for openvswitch fixes the following issues:
* CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580). * CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581). * CVE-2022-32166: Fixed a out of bounds read in minimask_equal() (bsc#1203865). * CVE-2021-36980: Fixed a use-after-free issue during the decoding of a RAW_ENCAP action (bsc#1188524).
## Patch Instructions:
To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* SUSE OpenStack Cloud 9 zypper in -t patch SUSE-OpenStack-Cloud-9-2023-2360=1
* SUSE OpenStack Cloud Crowbar 9 zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-2360=1
* SUSE Linux Enterprise Server for SAP Applications 12 SP4 zypper in -t patch SUSE-SLE-SAP-12-SP4-2023-2360=1
* SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2023-2360=1
* SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2023-2360=1
## Package List:
* SUSE OpenStack Cloud 9 (x86_64) * openvswitch-debugsource-2.8.10-4.33.1 * libopenvswitch-2_8-0-2.8.10-4.33.1 * openvswitch-2.8.10-4.33.1 * openvswitch-debuginfo-2.8.10-4.33.1 * libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1 * SUSE OpenStack Cloud Crowbar 9 (x86_64) * openvswitch-debugsource-2.8.10-4.33.1 * libopenvswitch-2_8-0-2.8.10-4.33.1 * openvswitch-2.8.10-4.33.1 * openvswitch-debuginfo-2.8.10-4.33.1 * libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64) * openvswitch-debugsource-2.8.10-4.33.1 * libopenvswitch-2_8-0-2.8.10-4.33.1 * openvswitch-2.8.10-4.33.1 * openvswitch-debuginfo-2.8.10-4.33.1 * libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1 * SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64) * openvswitch-debugsource-2.8.10-4.33.1 * libopenvswitch-2_8-0-2.8.10-4.33.1 * openvswitch-2.8.10-4.33.1 * openvswitch-debuginfo-2.8.10-4.33.1 * libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1 * SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64) * openvswitch-debugsource-2.8.10-4.33.1 * libopenvswitch-2_8-0-2.8.10-4.33.1 * openvswitch-2.8.10-4.33.1 * openvswitch-debuginfo-2.8.10-4.33.1 * libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1
## References:
* https://www.suse.com/security/cve/CVE-2021-36980.html * https://www.suse.com/security/cve/CVE-2022-32166.html * https://www.suse.com/security/cve/CVE-2022-4337.html * https://www.suse.com/security/cve/CVE-2022-4338.html * https://bugzilla.suse.com/show_bug.cgi?id=1188524 * https://bugzilla.suse.com/show_bug.cgi?id=1203865 * https://bugzilla.suse.com/show_bug.cgi?id=1206580 * https://bugzilla.suse.com/show_bug.cgi?id=1206581
--===============5082277004251994737== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
<div class="container"> <h1>Security update for openvswitch</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2023:2360-1</td> </tr> <tr> <th>Rating:</th> <td>important</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1188524">#1188524</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1203865">#1203865</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1206580">#1206580</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1206581">#1206581</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2021-36980.html">CVE-2021-36980</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2022-32166.html">CVE-2022-32166</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2022-4337.html">CVE-2022-4337</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2022-4338.html">CVE-2022-4338</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2021-36980</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">5.3</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2021-36980</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">5.5</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-32166</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">6.1</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-32166</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-4337</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.3</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-4337</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-4338</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.3</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-4338</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP4</li> <li class="list-group-item">SUSE OpenStack Cloud 9</li> <li class="list-group-item">SUSE OpenStack Cloud Crowbar 9</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves four vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for openvswitch fixes the following issues:</p> <ul> <li>CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV (bsc#1206580).</li> <li>CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific TLV (bsc#1206581).</li> <li>CVE-2022-32166: Fixed a out of bounds read in minimask_equal() (bsc#1203865).</li> <li>CVE-2021-36980: Fixed a use-after-free issue during the decoding of a RAW_ENCAP action (bsc#1188524).</li> </ul>
<h2>Patch Instructions:</h2> <p> To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> SUSE OpenStack Cloud 9 <br/> <code>zypper in -t patch SUSE-OpenStack-Cloud-9-2023-2360=1</code> </li> <li class="list-group-item"> SUSE OpenStack Cloud Crowbar 9 <br/> <code>zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-2360=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server for SAP Applications 12 SP4 <br/> <code>zypper in -t patch SUSE-SLE-SAP-12-SP4-2023-2360=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2023-2360=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2023-2360=1</code> </li> </ul>
<h2>Package List:</h2> <ul> <li> SUSE OpenStack Cloud 9 (x86_64) <ul> <li>openvswitch-debugsource-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-2.8.10-4.33.1</li> <li>openvswitch-2.8.10-4.33.1</li> <li>openvswitch-debuginfo-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1</li> </ul> </li> <li> SUSE OpenStack Cloud Crowbar 9 (x86_64) <ul> <li>openvswitch-debugsource-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-2.8.10-4.33.1</li> <li>openvswitch-2.8.10-4.33.1</li> <li>openvswitch-debuginfo-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1</li> </ul> </li> <li> SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64) <ul> <li>openvswitch-debugsource-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-2.8.10-4.33.1</li> <li>openvswitch-2.8.10-4.33.1</li> <li>openvswitch-debuginfo-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64) <ul> <li>openvswitch-debugsource-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-2.8.10-4.33.1</li> <li>openvswitch-2.8.10-4.33.1</li> <li>openvswitch-debuginfo-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64) <ul> <li>openvswitch-debugsource-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-2.8.10-4.33.1</li> <li>openvswitch-2.8.10-4.33.1</li> <li>openvswitch-debuginfo-2.8.10-4.33.1</li> <li>libopenvswitch-2_8-0-debuginfo-2.8.10-4.33.1</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2021-36980.html">https://www.suse.com/security/cve/CVE-2021-36980.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2022-32166.html">https://www.suse.com/security/cve/CVE-2022-32166.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2022-4337.html">https://www.suse.com/security/cve/CVE-2022-4337.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2022-4338.html">https://www.suse.com/security/cve/CVE-2022-4338.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1188524">https://bugzilla.suse.com/show_bug.cgi?id=1188524</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1203865">https://bugzilla.suse.com/show_bug.cgi?id=1203865</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1206580">https://bugzilla.suse.com/show_bug.cgi?id=1206580</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1206581">https://bugzilla.suse.com/show_bug.cgi?id=1206581</a> </li> </ul> </div>
--===============5082277004251994737==--
|
|
|
|