CVE-2017-14970

Debian Bug report logs - #877543
CVE-2017-14970

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2017-14970

Date: Mon, 02 Oct 2017 19:17:59 +0200

Source: openvswitch
Severity: important
Tags: security

Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14970

Cheers,
        Moritz

Message #10 received at 877543@bugs.debian.org (full text, mbox, reply):

From: Ben Pfaff <blp@ovn.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 877543@bugs.debian.org

Subject: Re: Bug#877543: CVE-2017-14970

Date: Mon, 2 Oct 2017 10:33:06 -0700

On Mon, Oct 02, 2017 at 07:17:59PM +0200, Moritz Muehlenhoff wrote:
> Source: openvswitch
> Severity: important
> Tags: security
> 
> Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14970

We don't think that these memory leaks are important because they can
only come from the OpenFlow controller, which has more powerful ways to
force memory allocations; for example, by inserting large numbers of
flows.

Message #19 received at 877543@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Ben Pfaff <blp@ovn.org>

Cc: 877543@bugs.debian.org

Subject: Re: Bug#877543: CVE-2017-14970

Date: Mon, 2 Oct 2017 20:33:30 +0200

On Mon, Oct 02, 2017 at 10:33:06AM -0700, Ben Pfaff wrote:
> On Mon, Oct 02, 2017 at 07:17:59PM +0200, Moritz Muehlenhoff wrote:
> > Source: openvswitch
> > Severity: important
> > Tags: security
> > 
> > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14970
> 
> We don't think that these memory leaks are important because they can
> only come from the OpenFlow controller, which has more powerful ways to
> force memory allocations; for example, by inserting large numbers of
> flows.

Ok. We've only learned about this CVE ID from the daily feed updates
from MITRE. Since you're upstream, could you contact MITRE via
https://cveform.mitre.org (and selecting the "Request an update to an 
existing CVE Entry" option) to have them mark the CVE ID as disputed
or rejected?

Cheers,
        Moritz

Message #24 received at 877543@bugs.debian.org (full text, mbox, reply):

From: Ben Pfaff <blp@ovn.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 877543@bugs.debian.org

Subject: Re: Bug#877543: CVE-2017-14970

Date: Mon, 2 Oct 2017 12:03:14 -0700

On Mon, Oct 02, 2017 at 08:33:30PM +0200, Moritz Mühlenhoff wrote:
> On Mon, Oct 02, 2017 at 10:33:06AM -0700, Ben Pfaff wrote:
> > On Mon, Oct 02, 2017 at 07:17:59PM +0200, Moritz Muehlenhoff wrote:
> > > Source: openvswitch
> > > Severity: important
> > > Tags: security
> > > 
> > > Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14970
> > 
> > We don't think that these memory leaks are important because they can
> > only come from the OpenFlow controller, which has more powerful ways to
> > force memory allocations; for example, by inserting large numbers of
> > flows.
> 
> Ok. We've only learned about this CVE ID from the daily feed updates
> from MITRE. Since you're upstream, could you contact MITRE via
> https://cveform.mitre.org (and selecting the "Request an update to an 
> existing CVE Entry" option) to have them mark the CVE ID as disputed
> or rejected?

OK, done.

Message #29 received at 877543-close@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: 877543-close@bugs.debian.org

Subject: Bug#877543: fixed in openvswitch 2.8.1+dfsg1-1

Date: Thu, 26 Oct 2017 09:00:34 +0000

Source: openvswitch
Source-Version: 2.8.1+dfsg1-1

We believe that the bug you reported is fixed in the latest version of
openvswitch, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 877543@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated openvswitch package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 20 Oct 2017 22:06:41 +0200
Source: openvswitch
Binary: openvswitch-common openvswitch-dbg openvswitch-dev openvswitch-ipsec openvswitch-pki openvswitch-switch openvswitch-testcontroller openvswitch-vtep ovn-central ovn-controller-vtep ovn-host python-openvswitch python3-openvswitch
Architecture: source amd64 all
Version: 2.8.1+dfsg1-1
Distribution: experimental
Urgency: medium
Maintainer: Debian OpenStack <openstack-devel@lists.alioth.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 openvswitch-common - Open vSwitch common components
 openvswitch-dbg - Debug symbols for Open vSwitch packages
 openvswitch-dev - Open vSwitch development package
 openvswitch-ipsec - Open vSwitch GRE-over-IPsec support
 openvswitch-pki - Open vSwitch public key infrastructure dependency package
 openvswitch-switch - Open vSwitch switch implementations
 openvswitch-testcontroller - Simple controller for testing OpenFlow setups
 openvswitch-vtep - Open vSwitch VTEP utilities
 ovn-central - OVN central components
 ovn-controller-vtep - OVN vtep controller
 ovn-host   - OVN host components
 python-openvswitch - Python bindings for Open vSwitch
 python3-openvswitch - Python 3 bindings for Open vSwitch
Closes: 771507 863228 863655 863661 863662 877543 878249 878757
Changes:
 openvswitch (2.8.1+dfsg1-1) experimental; urgency=medium
 .
   * New upstream release (Closes: #878249):
     - Fixes CVE-2017-9214 (Closes: #863228).
     - Fixes CVE-2017-14970 (Closes: #877543).
     - Fixes CVE-2017-9263 (Closes: #863655).
     - Fixes CVE-2017-9264 (Closes: #863661).
     - Fixes CVE-2017-9265 (Closes: #863662).
   * Ran wrap-and-sort -bast.
   * Add libopenvswitch and libopenvswitch-dev.
   * Updated VCS URLs.
   * Switched to debhelper 10.
   * Added openstack-pkg-tools as build-depends.
   * Standards-Version is now 4.1.1.
   * Added dh-python as build-depends.
   * Added 2 debian/*.service files (Closes: #878757, #771507).
   * Added Python 3 support.
   * Added debian/README.source explaining why we're marking the version as
     +dfsg1 (ie: because we remove the upstream debian folder).
   * Removed patches.
   * Patch upstream Makefile.am to not include debian/automake.mk.
   * Remove openvswitch-test package.
   * Simplify packaging by installing all binaries in openvswitch-common.
   * Removed build-depends on dh-autoreconf, satisfied by debhelper >= 10.
   * Fixed build-depends on automake.
   * Fixed runtime depends on openvswitch-common in openvswitch-pki.
   * Removed openvswitch-test package, now provided by openvswitch-common.
   * Switch debian/copyright to parsable format.
   * Add export DEB_BUILD_MAINT_OPTIONS=hardening=+bindnow in debian/rules.
   * Removed ovn-docker package, now provided by openvswitch-common.
   * Manually correctly installs ovs-vsctl-bashcomp.bash.
   * Add myself as uploader.
   * Added a watch file.
   * Init scripts now sourcing LSB functions.
   * Change priority from extra to optional, as per policy 4.0.1.
   * Remove ovn-common package, now provided by openvswitch-common.
   * Change Maintainer: to be Debian OpenStack.
Checksums-Sha1:
 40bbe7f1fac09641d9bc1e00b3dc1601fb41ca63 3237 openvswitch_2.8.1+dfsg1-1.dsc
 ddbee020007e4a1317a50717242bbb697481d9aa 3526228 openvswitch_2.8.1+dfsg1.orig.tar.xz
 d10b014529d91dca3dc1e522d01960268c03fc36 46356 openvswitch_2.8.1+dfsg1-1.debian.tar.xz
 3d961ffc2c5dc2626aaf87974d96c48c6df4fe2c 1606732 openvswitch-common_2.8.1+dfsg1-1_amd64.deb
 d0f3f39f2a0953cf4057e76ece54b77bea6cbf45 5282008 openvswitch-dbg_2.8.1+dfsg1-1_amd64.deb
 d7059580ec57f38323a08b272eb1d919ffb26ca0 1487180 openvswitch-dev_2.8.1+dfsg1-1_amd64.deb
 8222ba18fc5bd0990bcb7320f377a6b4f2968bfa 40252 openvswitch-ipsec_2.8.1+dfsg1-1_amd64.deb
 c3168c74c33562ccd30a965c0208fbbf4d117803 33760 openvswitch-pki_2.8.1+dfsg1-1_all.deb
 08309b10a6a460d5b5a6e06561b76702f8c7b586 56124 openvswitch-switch_2.8.1+dfsg1-1_amd64.deb
 03146c62cb51d82b49ffdb4a0cfced1495505252 37104 openvswitch-testcontroller_2.8.1+dfsg1-1_amd64.deb
 8b9b96d2e6b475f98d1893a815e7695db6c684b4 41836 openvswitch-vtep_2.8.1+dfsg1-1_amd64.deb
 8e90a31d41c07d115480035b684c0ca8f2e1205d 14395 openvswitch_2.8.1+dfsg1-1_amd64.buildinfo
 435d2d2072ca942e15744e17b2cccdce5fe38980 37016 ovn-central_2.8.1+dfsg1-1_amd64.deb
 f2fe46ab59e0ef825524fc2bb3fa866f3a409e92 33872 ovn-controller-vtep_2.8.1+dfsg1-1_amd64.deb
 f7f854c7b52551449f05565863f8d898784d72e8 34764 ovn-host_2.8.1+dfsg1-1_amd64.deb
 f371d2e4c58b8b870b24228f94856bad1b9fe8c8 103268 python-openvswitch_2.8.1+dfsg1-1_all.deb
 97907bb5989e532192b04be3b956a457dbacca35 94340 python3-openvswitch_2.8.1+dfsg1-1_all.deb
Checksums-Sha256:
 9160a286e6c0f4d3f150673ff4dc297927f523401e503ddb5ac5669c46d4f87f 3237 openvswitch_2.8.1+dfsg1-1.dsc
 e8e61f417bdaf160abebd0a0713e610a8faf5f464ac4547c59fa796e8c48b7d2 3526228 openvswitch_2.8.1+dfsg1.orig.tar.xz
 d55b3b03d7012e5aba2b4430c4f27ee583fd996f48a7d93972ec24575f50a69f 46356 openvswitch_2.8.1+dfsg1-1.debian.tar.xz
 b0f5e5080c41b4aeec83e3992e08d9114da7e0f78092b33c257a8297dd990466 1606732 openvswitch-common_2.8.1+dfsg1-1_amd64.deb
 47e8302d67dd71679c0587827995a1330438881d8260a059e07de97f49aa2193 5282008 openvswitch-dbg_2.8.1+dfsg1-1_amd64.deb
 43a50f59c576d03da04c6a5654cff415d6d64466d2b53dce55cc3c5df04cd6b2 1487180 openvswitch-dev_2.8.1+dfsg1-1_amd64.deb
 491e9635c977a77d183dbca7d8d2b035f7fe62446204874f308db9cf8b52e121 40252 openvswitch-ipsec_2.8.1+dfsg1-1_amd64.deb
 d7f185128d3391e9bf5ab6709fe54d243cda2fd8102b6ee462c6f96d3cb30de4 33760 openvswitch-pki_2.8.1+dfsg1-1_all.deb
 4d386ac4148328af59054587aa1c889198b5e1ae6b98549eb56bc8c4df04bc7f 56124 openvswitch-switch_2.8.1+dfsg1-1_amd64.deb
 1d3eb2c546a2e62fe58d01c7e442b9a06d8974802760e60b9c54cc6822e024ff 37104 openvswitch-testcontroller_2.8.1+dfsg1-1_amd64.deb
 707db91308ccb3617e7f05758ac6a6c802f952ba2c9b6577b598537eb17eaa62 41836 openvswitch-vtep_2.8.1+dfsg1-1_amd64.deb
 70cf8d3701986910f3efca3ccfebad72335d64fea15758558a05e27326a3d66d 14395 openvswitch_2.8.1+dfsg1-1_amd64.buildinfo
 8cd17842bea2e6aedcd14abefcced178d9db3abca1f66ed5becaec7b4e0e323d 37016 ovn-central_2.8.1+dfsg1-1_amd64.deb
 8c81c7abf7670c29eb82b6f5220e1aaac800dd75b86f9260ae966908579cd00f 33872 ovn-controller-vtep_2.8.1+dfsg1-1_amd64.deb
 ed3e990cf8addb18a6f5d803f085f28123b3b80affe0bf98814b5233b4044d06 34764 ovn-host_2.8.1+dfsg1-1_amd64.deb
 111d9991470ef85a0bcdf36a5b88748e22070f9d2a54fd86151028a93bfc9069 103268 python-openvswitch_2.8.1+dfsg1-1_all.deb
 cd22487fc5dc92f51427cfb812cf8d9872eaae44ebafab8b63ccf4e77c86e62a 94340 python3-openvswitch_2.8.1+dfsg1-1_all.deb
Files:
 0f6d8e9265b63963f09933cd3165ae51 3237 net optional openvswitch_2.8.1+dfsg1-1.dsc
 07d3648a888f410e1d2d8b433394d41d 3526228 net optional openvswitch_2.8.1+dfsg1.orig.tar.xz
 860062cb5c67cf269fe84da1c01cced1 46356 net optional openvswitch_2.8.1+dfsg1-1.debian.tar.xz
 043e1daa97ff7d61bf5937ddc75f7b0d 1606732 net optional openvswitch-common_2.8.1+dfsg1-1_amd64.deb
 ddfeedd2cc6e9e19420835f3c2a37f1a 5282008 debug optional openvswitch-dbg_2.8.1+dfsg1-1_amd64.deb
 2b6edd7f9137bcae0d003e4acf9c1f8d 1487180 net optional openvswitch-dev_2.8.1+dfsg1-1_amd64.deb
 5251139e50f810bcc854d9077938c88e 40252 net optional openvswitch-ipsec_2.8.1+dfsg1-1_amd64.deb
 2e611c44a86c6c4197f85ae095316a75 33760 net optional openvswitch-pki_2.8.1+dfsg1-1_all.deb
 bd02cbd56a52a1565604458a0a822dd7 56124 net optional openvswitch-switch_2.8.1+dfsg1-1_amd64.deb
 2cda0aeeeddf79bc004ee2469ef6f7a5 37104 net optional openvswitch-testcontroller_2.8.1+dfsg1-1_amd64.deb
 b9bcaa2a235eb66076c15014c33d03ed 41836 net optional openvswitch-vtep_2.8.1+dfsg1-1_amd64.deb
 6e431ce4c417ff571078783cd8159473 14395 net optional openvswitch_2.8.1+dfsg1-1_amd64.buildinfo
 378b5b1dd704e51ebace74c6873319de 37016 net optional ovn-central_2.8.1+dfsg1-1_amd64.deb
 e06253172f977dc5cdb642eff9b2029b 33872 net optional ovn-controller-vtep_2.8.1+dfsg1-1_amd64.deb
 076fd285510a8cea33dc7f03c960f9ec 34764 net optional ovn-host_2.8.1+dfsg1-1_amd64.deb
 cc579eff35d7a4596df200c536d4c792 103268 python optional python-openvswitch_2.8.1+dfsg1-1_all.deb
 4c61690e9ed29c14dc9ef2d21c1422f0 94340 python optional python3-openvswitch_2.8.1+dfsg1-1_all.deb

-----BEGIN PGP SIGNATURE-----

iQJEBAEBCAAuFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAlnxHjkQHHppZ29AZGVi
aWFuLm9yZwAKCRDUFq0VrGtD/iLbD/4xdXr9fCUkOw8cQZcdlbBkCYALJiFxDde4
Iq7l3YH+57ldTDh+RA0iDuiOek8/z5rgLVjS9Lc6RTLcZeub0CspSCf1JdHeTEBO
5NBaY0f0Q8/R9RL5It6+osCmywgUfHc2+6kRWrCKPK7d09PkSEixP577tLBs4Ge/
hgFlq0RVDMiVB8fXLRCx9venGO3rJkMFifQXksDaO14joEBEtUcj6ZXpGAy+3FGV
1BshrTjnC75ZGAcdN5pe6cV+dVItUFCQyRNGUUQ0QNd9nABcg2ZoBMiS2s24nBld
QdfVgzhTCtzpxg2SeWau4dYG0WUyMU7BkO33CkalW4LgptdbdlpcF2flnCiC9hK5
Iai5gnABu8NiJt2jRyCPYysX8D3E0na+pNuazkfnHB+WFY70pJOKPQOaVg5Hm7mz
SIr6XmNLRRVOdSC9OpCoOAfhwrN8bDjfud3JiyPcD3l2VBLWn0Gd0NCcaQPHwZHe
6CvpAGWVClkyysCaWuRdKLjbCME9A4onA6+oA3F7W8pj6xeE9WKfTr64G0XxvSji
oDV0MY/RucqrXQxQW/KqtvOlOTu6VMlXpbHMatcNxBpNeBY3Y3jLO8Djzo3O97bW
z+Vi8420XgXx8vcepZwcrpljSY9ESQbVQVqc4e1apYKTdvoej3P5CAlq2eE63Qn6
upKy2ASfNA==
=skuV
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.