GHSA-mcpw-cp35-p3h8

OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-15753

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	os-vif	>= 1.15.0, < 1.15.2	1.15.2
PyPI	os-vif	>= 1.16.0, < 1.17.0	1.17.0

Details

As written in the advisory (Markdown source, shown as plain text).

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in `internal/command/ip/linux/impl_pyroute2.py`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-15753 advisory
https://github.com/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aef web
https://github.com/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7 web
https://github.com/openstack/os-vif package
https://launchpad.net/bugs/1837252 web
https://review.opendev.org/672834 web
https://review.opendev.org/678098 web
https://security.openstack.org/ossa/OSSA-2019-004.html web
http://www.openwall.com/lists/oss-security/2019/08/29/2 web