python-os-vif: CVE-2019-15753

Debian Bug report logs - #939288
python-os-vif: CVE-2019-15753

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: python-os-vif: CVE-2019-15753

Date: Mon, 02 Sep 2019 21:38:08 +0200

Source: python-os-vif
Version: 1.15.1-2
Severity: grave
Tags: security upstream
Forwarded: https://launchpad.net/bugs/1837252 

Hi,

The following vulnerability was published for python-os-vif.

CVE-2019-15753[0]:
| In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC
| aging time of 0 disables MAC learning in linuxbridge, forcing
| obligatory Ethernet flooding of non-local destinations, which both
| impedes network performance and allows users to possibly view the
| content of packets for instances belonging to other tenants sharing
| the same network. Only deployments using the linuxbridge backend are
| affected. This occurs in PyRoute2.add() in
| internal/command/ip/linux/impl_pyroute2.py.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-15753
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15753
[1] https://launchpad.net/bugs/1837252
[2] https://security.openstack.org/ossa/OSSA-2019-004.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.