Bug 765346 (CVE-2020-27827) – <net-misc/openvswitch-2.14.1: Denial of service (CVE-2020-27827)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2021-01-13 19:40:46 UTC]

"Multiple versions of Open vSwitch are vulnerable to denial of service
attacks in which crafted LLDP packets could cause memory to be lost
when allocating data to handle specific optional TLVs.  Triggering the
vulnerability requires LLDP processing to be enabled for a specific
port.  Open vSwitch versions before 2.5.x are not vulnerable.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
previously assigned the identifier CVE-2020-27827 to this issue for
the `lldpd` project, and the Open vSwitch project."

[Comment 1 Matthew Thode ( prometheanfire ) 2021-01-13 20:36:39 UTC]

this is fixed (2.14.1 added and fast stabled with cleanup)

[Comment 2 Thomas Deutschmann (RETIRED) 2021-05-31 21:01:49 UTC]

Waiting for bug 769995.

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:24:33 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:33:04 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 17:40:55 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(6, 1, 'Toggle comment display'); Comment 6 NATTkA bot 2021-07-29 17:49:05 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-07-29 18:05:00 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 8 NATTkA bot 2021-07-29 18:13:19 UTC]

Package list is empty or all packages have requested keywords.

[Comment 9 Larry the Git Cow 2023-11-26 10:07:48 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=6109db58da8356109819f2e31a15acb75bbd5b61

commit 6109db58da8356109819f2e31a15acb75bbd5b61
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-11-26 10:06:58 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2023-11-26 10:07:30 +0000

    [ GLSA 202311-16 ] Open vSwitch: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/765346
    Bug: https://bugs.gentoo.org/769995
    Bug: https://bugs.gentoo.org/803107
    Bug: https://bugs.gentoo.org/887561
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202311-16.xml | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)