Critical severity9.1NVD Advisory· Published Aug 28, 2019· Updated Jun 17, 2026
CVE-2019-15753
CVE-2019-15753
Description
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
os-vifPyPI | >= 1.15.0, < 1.15.2 | 1.15.2 |
os-vifPyPI | >= 1.16.0, < 1.17.0 | 1.17.0 |
Affected products
4- OpenStack/os-vifdescription
Patches
Vulnerability mechanics
References
9- www.openwall.com/lists/oss-security/2019/08/29/2nvdMailing ListPatchThird Party AdvisoryWEB
- review.opendev.org/672834nvdPatchWEB
- review.opendev.org/678098nvdPatchWEB
- security.openstack.org/ossa/OSSA-2019-004.htmlnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-mcpw-cp35-p3h8ghsaADVISORY
- launchpad.net/bugs/1837252nvdIssue TrackingThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2019-15753ghsaADVISORY
- github.com/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aefghsaWEB
- github.com/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7ghsaWEB
News mentions
0No linked articles in our index yet.