CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
VendorProductVersion
openvswitchopenvswitch
𝑥
< 2.13.10
openvswitchopenvswitch
2.14.0 ≤
𝑥
< 2.14.8
openvswitchopenvswitch
2.15.0 ≤
𝑥
< 2.15.7
openvswitchopenvswitch
2.16.0 ≤
𝑥
< 2.16.6
openvswitchopenvswitch
2.17.0 ≤
𝑥
< 2.17.5
openvswitchopenvswitch
3.0.0 ≤
𝑥
< 3.0.3
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openvswitch
bullseye (security)
2.15.0+ds1-2+deb11u5
fixed
bullseye
2.15.0+ds1-2+deb11u5
fixed
bookworm
3.1.0-2+deb12u1
fixed
bookworm (security)
3.1.0-2+deb12u1
fixed
sid
3.4.0-1
fixed
trixie
3.4.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openvswitch
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
Fixed 3.0.3-0ubuntu0.22.10.2
released
jammy
Fixed 2.17.3-0ubuntu0.22.04.2
released
focal
Fixed 2.13.8-0ubuntu1.1
released
bionic
Fixed 2.9.8-0ubuntu0.18.04.4
released
xenial
needs-triage
trusty
ignored
Common Weakness Enumeration
References
https://github.com/openvswitch/ovs/pull/405
https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
https://security.gentoo.org/glsa/202311-16
https://www.debian.org/security/2023/dsa-5319
https://www.openwall.com/lists/oss-security/2022/12/21/4
https://github.com/openvswitch/ovs/pull/405
https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
https://security.gentoo.org/glsa/202311-16
https://www.debian.org/security/2023/dsa-5319
https://www.openwall.com/lists/oss-security/2022/12/21/4