Impact: Low Public Date: 2019-08-28 CWE: CWE-200 Bugzilla: 1747255: CVE-2019-15753 python-os-vif: Hard-coded MAC aging time of 0 disables MAC learning in linuxbridge In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2019-15753 from the MITRE CVE dictionary dictionary and NIST NVD.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 3.1 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Attack Vector | Adjacent Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity Impact | None |
| Availability Impact | None |
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 14.0 (Rocky) | python-os-vif | Under investigation |
| Red Hat OpenStack Platform 13.0 (Queens) | python-os-vif | Under investigation |
| Red Hat OpenStack Platform 10 | python-os-vif | Under investigation |
Vulmon