huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-35942: glibc: Arbitrary read in wordexp()
Component: glibc
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2021-06-30T00:00:00+00:00

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input.

Statement: This is an integer overflow flaw in wordexp(), caused by a specially crafted untrusted regular expression input. It can result in arbitrary memory read. The upstream glibc project generally does not consider bugs due to untrusted inputs as security issues, but this is an exception since it invokes undefined behaviour in glibc. In general, use of untrusted regular expression input is strongly discouraged. This flaw has been rated as having a security impact of Moderate as no application shipped with Red Hat Enterprise Linux passes untrusted data to wordexp() by default.

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.34
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 5adda61f62b77384718b4c0d8336ade8f2b4b35c
CVE-2021-3602: buildah: Host environment variables leaked in build container when using chroot isolation
Component: buildah
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2021-07-15T14:00:00+00:00

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Statement: OpenShift Container Platform 4's builder container is not vulnerable to this flaw as it uses OCI isolation (i.e. using runc) and does not use chroot isolation.

Affected upstream versions: Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above.
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/containers/buildah
Upstream fix commit: a468ce0ffd347035d53ee0e26c205ef604097fb0
CVE-2021-36084: libsepol: use-after-free in __cil_verify_classperms()
Component: libsepol
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-19T00:00:00+00:00

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).


Affected upstream versions: n/a
Fixed upstream versions: 3.3
Upstream repository: https://github.com/SELinuxProject/selinux
Upstream fix commit: f34d3d30c8325e4847a6b696fe7a3936a8a361f3
CVE-2021-36085: libsepol: use-after-free in __cil_verify_classperms()
Component: libsepol
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-19T00:00:00+00:00

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).


Affected upstream versions: n/a
Fixed upstream versions: 3.3
Upstream repository: https://github.com/SELinuxProject/selinux
Upstream fix commit: 2d35fcc7e9e976a2346b1de20e54f8663e8a6cba
CVE-2021-36086: libsepol: use-after-free in cil_reset_classpermission()
Component: libsepol
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-19T00:00:00+00:00

The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).


Affected upstream versions: n/a
Fixed upstream versions: 3.3
Upstream repository: https://github.com/SELinuxProject/selinux
Upstream fix commit: c49a8ea09501ad66e799ea41b8154b6770fec2c8
CVE-2021-36087: libsepol: heap-based buffer overflow in ebitmap_match_any()
Component: libsepol
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2021-04-19T00:00:00+00:00

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.


Affected upstream versions: n/a
Fixed upstream versions: 3.3
Upstream repository: https://github.com/SELinuxProject/selinux
Upstream fix commit: 340f0eb7f3673e8aacaf0a96cbfcd4d12a405521
CVE-2021-3609: kernel: race condition in net/can/bcm.c leads to local privilege escalation
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-06-19T00:00:00+00:00

A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available.

For Red Hat Virtualization, this flaw is rated Moderate as CAN is not used on host nodes.

Affected upstream versions: Affects kernel v2.6.25 to v5.13-rc6
Fixed upstream versions: v5.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d5f9023fa61ee8b94f37a93f08e94b136cf1e463
CVE-2021-3620: Ansible: ansible-connection module discloses sensitive info in traceback error message
Component: Ansible
Severity: Important
CWE: CWE-209 (Generation of Error Message Containing Sensitive Information)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-06-25T00:00:00+00:00

A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

Statement: Red Hat Gluster Storage 3 no longer maintains its own version of Ansible. The prerequisite is to enable the Ansible repository in order to consume the latest version of Ansible, which has many bug and security fixes.

Red Hat Ceph Storage 2 only provides fixes for bugs on an as-requested basis by a customer, and will not be fixed after discussion with engineering about the viability of a fix. Red Hat Ceph Storage 3 does not directly ship ansible, and thus is closed as won't fix.

Red Hat Virtualization ships an affected version of ansible, however, the usage of ansible on the redhat-virtualization-host is only supported for self-hosted-engine installation and disaster recovery, where it is run locally. As such Impact is rated Moderate.

Affected upstream versions: Fixed in Ansible Engine v2.9.27
Upstream repository: https://github.com/ansible/ansible
Upstream fix commit: fe28767970c8ec62aabe493c46b53a5de1e5fac0
CVE-2021-3622: hivex: stack overflow due to recursive call of _get_children()
Component: hivex
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2021-08-02T00:00:00+00:00

A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability.

Statement: Any external program using the hivex library could be exposed to partial unavailability in case of a crash where a user can always retry the operation. As for libguestfs, a crash in hivex would not result in libguestfs crashing.

Affected upstream versions: hivex-1.3.21
Fixed upstream versions: v1.3.21
Upstream repository: https://github.com/libguestfs/hivex
Upstream fix commit: 771728218dac2fbf6997a7e53225e75a4c6b7255
CVE-2021-36222: krb5: Sending a request containing PA-ENCRYPTED-CHALLENGE padata element without using FAST could result in NULL dereference in KDC which leads to DoS
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-12T00:00:00+00:00

A flaw was found in krb5. This flaw allows an unauthenticated attacker to cause a NULL dereference in the KDC by sending a request containing a PA-ENCRYPTED-CHALLENGE padata element without using FAST. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.20-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: fc98f520caefff2e5ee9a0026fdf5109944b3562
CVE-2021-3631: libvirt: Insecure sVirt label generation
Component: libvirt
Severity: Low
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 3 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)
Public date: 2021-04-13T00:00:00+00:00

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: This flaw affects all versions of `libvirt` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this issue.

Affected upstream versions: Fixed-In - libvirt v7.5.0
Fixed upstream versions: v7.5.0
Upstream repository: https://gitlab.com/libvirt/libvirt
Upstream fix commit: 15073504dbb624d3f6c911e85557019d3620fdb2
CVE-2021-3632: keycloak: Anyone can register a new device when there is no device registered for passwordless login
Component: keycloak
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-06-12T00:00:00+00:00

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.


Affected upstream versions: Fixed in v15.1.0
Fixed upstream versions: 15.1.0
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 65480cb5a11630909c086f79d396004499fbd1e4
CVE-2021-3639: mod_auth_mellon: Open Redirect vulnerability in logout URLs
Component: mod_auth_mellon
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2021-07-29T00:00:00+00:00

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.


Affected upstream versions: Fixed in v0.18.0
Fixed upstream versions: v0.18.0
Upstream repository: https://github.com/latchset/mod_auth_mellon
Upstream fix commit: 42a11261b9dad2e48d70bdff7c53dd57a12db6f5
CVE-2021-3640: kernel: use-after-free vulnerability in function sco_sock_sendmsg()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-18T00:00:00+00:00

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Statement: This issue is rated as having a Moderate impact because of the privileges (CAP_NET_ADMIN in initial namespace) required for exploiting the issue.

Affected upstream versions: Affects kernel v5.15.3 and prior, Fixed in v5.16-rc1 and above.
Fixed upstream versions: v5.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/bluetooth/sco.c
Upstream fix commit: 99c23da0eed4fd20cae8243f2b51e10e66aa0951
CVE-2021-3644: wildfly-core: Invalid Sensitivity Classification of Vault Expression
Component: wildfly-core
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)
Public date: 2021-07-14T00:00:00+00:00

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

Statement: Red Hat CodeReady Studio 12 is not affected by this flaw as it does not ship the vulnerable component of wildfly.

Affected upstream versions: Fixed in 16.0.1.Final, 17.0.0.Final and later.
Fixed upstream versions: 17.0.0.Final
Upstream repository: https://github.com/wildfly/wildfly-core
Upstream fix commit: 6d8db43cd43b5994b7a14003db978064e086090b
CVE-2021-3654: openstack-nova: novnc allows open redirection
Component: openstack-nova
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Public date: 2021-05-13T00:00:00+00:00

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.


Affected upstream versions: Affects - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.3 | Fixed-In 21.2.3, 22.3.0, and 23.1.0
Upstream repository: https://opendev.org/openstack/nova
Upstream fix commit: 04d48527b62a35d912f93bc75613a6cca606df66
CVE-2021-3656: kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)
Component: kernel
Severity: Moderate
CWE: CWE-862 (Missing Authorization)
CVSS v3: 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-08-16T12:00:00+00:00

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

Statement: The nested virtualization feature is not enabled by default up to Red Hat Enterprise Linux 8.4. Most importantly, Red Hat currently provides nested virtualization only as a Technology Preview, and is therefore unsupported for production use. For additional details please see https://access.redhat.com/solutions/21101 and https://access.redhat.com/support/offerings/techpreview.

Affected upstream versions: Fixed-In v5.14-rc7 and above
Fixed upstream versions: for-linus-part2
Upstream repository: https://git.kernel.org/pub/scm/virt/kvm/kvm.git
Upstream fix commit: c7dfa4009965a9b2d7b329ee970eb8da0d32f0bc
CVE-2021-3659: kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c
Component: kernel
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-04-06T19:22:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.


Affected upstream versions: Fixed in Kernel 5.12
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1165affd484889d4986cf3b724318935a0b120d8
CVE-2021-3660: cockpit: pages vulnerable to clickjacking
Component: cockpit
Severity: Low
CWE: CWE-1021 (Improper Restriction of Rendered UI Layers or Frames)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2021-07-20T00:00:00+00:00

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Statement: In cockpit versions 236 and above (Red Hat Enterprise Linux 8.4 and above), this flaw should not be exploitable, as the session cookie has the `SameSite=Strict;` option enabled, preventing the Web Browsers to reuse it from 3rd party web sites. This results in the cockpit website not being logged in when coming from an embedded 3rd party web site.

Affected upstream versions: Fixed in cockpit v254 and later.
Fixed upstream versions: 254
Upstream repository: https://github.com/cockpit-project/cockpit
Upstream fix commit: 8d9bc10d8128aae03dfde62fd00075fe492ead10
CVE-2021-3667: libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API
Component: libvirt
Severity: Low
CWE: CWE-667 (Improper Locking)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-21T00:00:00+00:00

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

Statement: This flaw affects all versions of `libvirt` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this issue.

Affected upstream versions: Fixedin - libvert v7.6.0-rc1 and above
Fixed upstream versions: v7.6.0
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: 447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87
CVE-2021-36740: varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request
Component: varnish
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-13T00:00:00+00:00

A flaw was found in Varnish. The Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. As a result, this flaw allows the information on the Varnish cache to be poisoned. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: varnish-6.0.8
Upstream repository: https://github.com/varnishcache/varnish-cache
Upstream fix commit: 9be22198e258d0e7a5c41f4291792214a29405cf
CVE-2021-3679: kernel: DoS in rb_per_cpu_empty()
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-20T09:00:00+00:00

A lack of CPU resources in the Linux kernel tracing module functionality was found in the way users use the trace ring buffer in specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.


Affected upstream versions: kernel 5.14-rc3
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 67f0d6d9883c13174669f88adac4f0ee656cc16a
CVE-2021-3684: assisted-installer: Image Pull Secret leaked through log files
Component: assisted-installer
Severity: Moderate
CWE: CWE-532 (Insertion of Sensitive Information into Log File)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2022-10-19T00:00:00+00:00

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.


Affected upstream versions: openshift/assisted-installer 1.0.25.1, openshift/assisted-installer 2.0.0
Fixed upstream versions: v1.0.25.1
Upstream repository: https://github.com/openshift/assisted-installer
Upstream fix commit: f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a
CVE-2021-3690: undertow: buffer leak on incoming websocket PONG message may lead to DoS
Component: undertow
Severity: Important
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-30T00:00:00+00:00

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Statement: Although Red Hat OpenStack Platform packages the vulnerable code in Opendaylight, it does not use or support the undertow-encapsulating features. The security impact for RHOSP is therefore rated as Low and no update will be provided at this time.

Affected upstream versions: Fixed in 2.2.10.Final, 2.0.40.Final
Fixed upstream versions: 2.2.10.Final
Upstream repository: https://github.com/undertow-io/undertow
Upstream fix commit: c7e84a0b7efced38506d7d1dfea5902366973877
CVE-2021-36980: openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action
Component: openvswitch
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-02-23T00:00:00+00:00

Open vSwitch (aka openvswitch) has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.

Affected upstream versions: n/a
Fixed upstream versions: v2.16.0
Upstream repository: https://github.com/openvswitch/ovs
Upstream fix commit: 77cccc74deede443e8b9102299efc869a52b65b2