{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2024-2182", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-03-05T00:40:55.429Z", "datePublished": "2024-03-12T16:18:31.829Z", "dateUpdated": "2024-09-13T23:37:29.396Z" }, "containers": { "cna": { "title": "Ovn: insufficient validation of bfd packets may lead to denial of service", "metrics": [ { "other": { "content": { "value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, that can trigger a denial of service." } ], "affected": [ { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn23.06", "defaultStatus": "affected", "versions": [ { "version": "0:23.06.1-112.el8fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.12", "defaultStatus": "affected", "versions": [ { "version": "0:22.12.1-94.el8fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.03", "defaultStatus": "affected", "versions": [ { "version": "0:22.03.3-71.el8fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn23.03", "defaultStatus": "affected", "versions": [ { "version": "0:23.03.1-100.el8fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn-2021", "defaultStatus": "affected", "versions": [ { "version": "0:21.12.0-142.el8fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn23.09", "defaultStatus": "affected", "versions": [ { "version": "0:23.09.0-136.el9fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn23.06", "defaultStatus": "affected", "versions": [ { "version": "0:23.06.1-112.el9fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.12", "defaultStatus": "affected", "versions": [ { "version": "0:22.12.1-94.el9fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.03", "defaultStatus": "affected", "versions": [ { "version": "0:22.03.3-71.el9fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn23.03", "defaultStatus": "affected", "versions": [ { "version": "0:23.03.1-100.el9fdp", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn2.11", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:7::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn2.12", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:7::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn2.13", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:7::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn2.11", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn2.12", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn2.13", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.06", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.09", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn-2021", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.06", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] }, { "vendor": "Red Hat", "product": "Fast Datapath for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovn22.09", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::fastdatapath" ] } ], "references": [ { "url": "https://access.redhat.com/errata/RHSA-2024:1385", "name": "RHSA-2024:1385", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1386", "name": "RHSA-2024:1386", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1387", "name": "RHSA-2024:1387", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1388", "name": "RHSA-2024:1388", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1390", "name": "RHSA-2024:1390", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1391", "name": "RHSA-2024:1391", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1392", "name": "RHSA-2024:1392", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1393", "name": "RHSA-2024:1393", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1394", "name": "RHSA-2024:1394", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:4035", "name": "RHSA-2024:4035", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2024-2182", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267840", "name": "RHBZ#2267840", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://mail.openvswitch.org/pipermail/ovs-announce/2024-March/000346.html" }, { "url": "https://www.openwall.com/lists/oss-security/2024/03/12/5" } ], "datePublic": "2024-03-12T00:00:00+00:00", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-346", "description": "Origin Validation Error", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-346: Origin Validation Error", "timeline": [ { "lang": "en", "time": "2024-03-04T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2024-03-12T00:00:00+00:00", "value": "Made public." } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Frode Nordahl (Canonical) for reporting this issue." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-09-13T23:37:29.396Z" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-2182", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-03-13T14:24:40.610508Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:22:21.535Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:03:39.232Z" }, "title": "CVE Program Container", "references": [ { "url": "http://www.openwall.com/lists/oss-security/2024/03/12/5", "tags": [ "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1385", "name": "RHSA-2024:1385", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1386", "name": "RHSA-2024:1386", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1387", "name": "RHSA-2024:1387", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1388", "name": "RHSA-2024:1388", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1390", "name": "RHSA-2024:1390", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1391", "name": "RHSA-2024:1391", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1392", "name": "RHSA-2024:1392", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1393", "name": "RHSA-2024:1393", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:1394", "name": "RHSA-2024:1394", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:4035", "name": "RHSA-2024:4035", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2024-2182", "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267840", "name": "RHBZ#2267840", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APR4GCVCMQD3DQUKXDNGIXCCYGE5V7IT/", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CB4N522FCS4XWAPUKRWZF6QZ657FCIDF/", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XRKXOOOKD56TY3JQVB45N3GCTX3EG4BV/", "tags": [ "x_transferred" ] }, { "url": "https://mail.openvswitch.org/pipermail/ovs-announce/2024-March/000346.html", "tags": [ "x_transferred" ] }, { "url": "https://www.openwall.com/lists/oss-security/2024/03/12/5", "tags": [ "x_transferred" ] } ] } ] } }