critique
CVE-2019-15753
python-os-vif: Hard-coded MAC aging time of 0 disables MAC learning in linuxbridge
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat5.2CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (moyenne), Ubuntu (faible).
Description
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | os-vif | 1.15.2, 1.17.0 |
| debian 11 | python-os-vif | 1.15.2-1 |
| debian 12 | python-os-vif | 1.15.2-1 |
| debian 13 | python-os-vif | 1.15.2-1 |
| debian 14 | python-os-vif | 1.15.2-1 |
| echo | python-os-vif | 1.15.2-1 |
| Red Hat | python3-os-vif | pas de correctif indiqué |
| ubuntu 20.04-ESM | python-os-vif | pas de correctif indiqué |
| ubuntu 22.04 | python-os-vif | pas de correctif indiqué |
Références
- http://www.openwall.com/lists/oss-security/2019/08/29/2
- https://access.redhat.com/security/cve/CVE-2019-15753
- https://github.com/openstack/os-vif
- https://github.com/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aef
- https://github.com/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7
- https://launchpad.net/bugs/1837252
- https://nvd.nist.gov/vuln/detail/CVE-2019-15753
- https://review.opendev.org/672834