Security update for openvswitch SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0239-1 Final 1 1 2021-02-05T15:13:49Z current 2021-02-05T15:13:49Z 2021-02-05T15:13:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openvswitch This update for openvswitch fixes the following issues: - openvswitch was updated to 2.13.2 - CVE-2020-27827: Fixed a memory leak when parsing lldp packets (bsc#1181345) This update was imported from the SUSE:SLE-15-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-239 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZBHQUGIHMXL62CWXH7ZTZ3HUSFCNG7DW/ E-Mail link for openSUSE-SU-2021:0239-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1117483 SUSE Bug 1117483 https://bugzilla.suse.com/1181345 SUSE Bug 1181345 https://www.suse.com/security/cve/CVE-2020-27827/ SUSE CVE CVE-2020-27827 page openSUSE Leap 15.2 libopenvswitch-2_13-0-2.13.2-lp152.3.9.1 libovn-20_03-0-20.03.1-lp152.3.9.1 openvswitch-2.13.2-lp152.3.9.1 openvswitch-devel-2.13.2-lp152.3.9.1 openvswitch-doc-2.13.2-lp152.3.9.1 openvswitch-ipsec-2.13.2-lp152.3.9.1 openvswitch-pki-2.13.2-lp152.3.9.1 openvswitch-test-2.13.2-lp152.3.9.1 openvswitch-vtep-2.13.2-lp152.3.9.1 ovn-20.03.1-lp152.3.9.1 ovn-central-20.03.1-lp152.3.9.1 ovn-devel-20.03.1-lp152.3.9.1 ovn-doc-20.03.1-lp152.3.9.1 ovn-docker-20.03.1-lp152.3.9.1 ovn-host-20.03.1-lp152.3.9.1 ovn-vtep-20.03.1-lp152.3.9.1 python3-ovs-2.13.2-lp152.3.9.1 libopenvswitch-2_13-0-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 libovn-20_03-0-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-devel-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-doc-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-ipsec-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-pki-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-test-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 openvswitch-vtep-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-central-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-devel-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-doc-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-docker-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-host-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 ovn-vtep-20.03.1-lp152.3.9.1 as a component of openSUSE Leap 15.2 python3-ovs-2.13.2-lp152.3.9.1 as a component of openSUSE Leap 15.2 A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. CVE-2020-27827 openSUSE Leap 15.2:libopenvswitch-2_13-0-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:libovn-20_03-0-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-devel-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-doc-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-ipsec-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-pki-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-test-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:openvswitch-vtep-2.13.2-lp152.3.9.1 openSUSE Leap 15.2:ovn-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:ovn-central-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:ovn-devel-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:ovn-doc-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:ovn-docker-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:ovn-host-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:ovn-vtep-20.03.1-lp152.3.9.1 openSUSE Leap 15.2:python3-ovs-2.13.2-lp152.3.9.1 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZBHQUGIHMXL62CWXH7ZTZ3HUSFCNG7DW/ https://www.suse.com/security/cve/CVE-2020-27827.html CVE-2020-27827 https://bugzilla.suse.com/1181345 SUSE Bug 1181345