Critical severityNVD Advisory· Published Aug 28, 2019· Updated Aug 5, 2024
CVE-2019-15753
CVE-2019-15753
Description
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
os-vifPyPI | >= 1.15.0, < 1.15.2 | 1.15.2 |
os-vifPyPI | >= 1.16.0, < 1.17.0 | 1.17.0 |
Affected products
2- OpenStack/os-vifdescription
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-mcpw-cp35-p3h8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-15753ghsaADVISORY
- www.openwall.com/lists/oss-security/2019/08/29/2ghsamailing-listx_refsource_MLISTWEB
- github.com/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aefghsaWEB
- github.com/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7ghsaWEB
- launchpad.net/bugs/1837252ghsax_refsource_MISCWEB
- review.opendev.org/672834ghsax_refsource_MISCWEB
- review.opendev.org/678098ghsax_refsource_MISCWEB
- security.openstack.org/ossa/OSSA-2019-004.htmlghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.