[USN-3873-1] Open vSwitch vulnerabilities


This is an OpenPGP/MIME signed message (RFC 4880 and 3156)

protocol=”application/pgp-signature”;
boundary=”srUmAwDOhNaOaUEIbeawt8SyKxnn4wuhb”

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
–srUmAwDOhNaOaUEIbeawt8SyKxnn4wuhb

protected-headers=”v1″
From: Marc Deslauriers
Reply-To: Ubuntu Security
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID:
Subject: [USN-3873-1] Open vSwitch vulnerabilities

–aTc4V7v34ecUT7gE6YSiAjp97R5sr5nlr

Content-Language: en-CA
Content-Transfer-Encoding: quoted-printable

=
=

Ubuntu Security Notice USN-3873-1
January 30, 2019

openvswitch vulnerabilities
=
=

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Open vSwitch.

Software Description:
– openvswitch: Ethernet virtual switch

Details:

It was discovered that Open vSwitch incorrectly decoded certain packets. =
A
remote attacker could possibly use this issue to cause Open vSwitch to
crash, resulting in a denial of service. (CVE-2018-17204)

It was discovered that Open vSwitch incorrectly handled processing certai=
n
flows. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS. (CVE-2018-17205)

It was discovered that Open vSwitch incorrectly handled BUNDLE action
decoding. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. (CVE-2018-17206)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
openvswitch-common 2.9.2-0ubuntu0.18.04.3

Ubuntu 16.04 LTS:
openvswitch-common 2.5.5-0ubuntu0.16.04.2

In general, a standard system update will make all the necessary changes.=

References:
https://usn.ubuntu.com/usn/usn-3873-1
CVE-2018-17204, CVE-2018-17205, CVE-2018-17206

Package Information:
https://launchpad.net/ubuntu/+source/openvswitch/2.9.2-0ubuntu0.18.04.3=

https://launchpad.net/ubuntu/+source/openvswitch/2.5.5-0ubuntu0.16.04.2=

–aTc4V7v34ecUT7gE6YSiAjp97R5sr5nlr–

–srUmAwDOhNaOaUEIbeawt8SyKxnn4wuhb

Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename=”signature.asc”

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlxRrbIACgkQZWnYVadE
vpNXlA//cxJ+QnZvFPM7KKyfWcQVx4s8CMW0iNsgfBG0aLv3L1vHEaLAcx3JW/0f
pxJNyldqsjV7cKMwu21+ok2GOWqxpZGRdEOeYwBh6skhXKF5qYOWorNcN7Z1ZcBK
WnnfSlHaE7FH2P8HVAvZUtfL+BSIy7IhYPfROGp+QKnjPdtD6wBsBr4teN2ZbMsz
Xgmnyf/f0X78osDfg1NaR7oJoChQN9A/oz+EvVOz/PeOgol33UCWO0DgwrsuQvuo
du8hDDMQiR3lSHqxiFvkWWiF8G5P2aZMUNVYh2++jjQsCiQKjwUXDhbntQ1A+9aX
whhpT/HjfdgFy5SEu+7NEIkEMG38OqKmNwI769bGREzyr9wvIn5TlkFUYAFLOvKr
Mny1AY/Zpvi4GArjOkCL73QrFVCgPpGjOagC7xgzy1Rwg3mTy08aJPrnPiOvFShI
KrPypjmAcNc0rwrx3lEMww7i4f/Mym3iBFem1tGMeD0NRLq+7g1IPScQNg6K2/Q7
rlgBNHog8iKLONwSTjErm32JmJfbsAbhyXP+uqQFb1tcuLMdlggrUSXx72h5cySs
0q9JYy/HVS1/Gwwke9pSy3O8s+Su9zSWuuhwiQqO6bT2h+abCmXijGi/5C2Qga42
ZDNRZy93xq2umDBFKJyAxBaJ6tq1ZTmtnWKJ4UtoKniFhofg5fE=
=K/JG
—–END PGP SIGNATURE—–

–srUmAwDOhNaOaUEIbeawt8SyKxnn4wuhb–

MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK