What is the severity of CVE-2017-14970?

CVE-2017-14970 has a medium severity due to potential memory leaks affecting Open vSwitch versions prior to 2.8.1.

How do I fix CVE-2017-14970?

To remediate CVE-2017-14970, upgrade Open vSwitch to version 2.8.1 or later.

What causes CVE-2017-14970?

CVE-2017-14970 is caused by multiple memory leaks during the parsing of malformed OpenFlow group mod messages.

Which versions of Open vSwitch are affected by CVE-2017-14970?

Open vSwitch versions prior to 2.8.1 are affected by CVE-2017-14970.

Is there a workaround for CVE-2017-14970?

There is no official workaround for CVE-2017-14970; upgrading to a fixed version is the recommended approach.

Vulnerability/
CVE-2017-14970

medium

5.9

CWE

772

2/10/2017

3/10/2019

CVE-2017-14970

First published: Mon Oct 02 2017(Updated: )

In lib/ofp-util.c in Open vSwitch (OvS) before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more direct and powerful ways to force Open vSwitch to allocate memory, such as by inserting flows into the flow table."

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Open vSwitch	<=2.8.0

Remedy

https://mail.openvswitch.org/pipermail/ovs-dev/2017-September/339085.html

Remedy

https://mail.openvswitch.org/pipermail/ovs-dev/2017-September/339086.html

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2017-14970?
CVE-2017-14970 has a medium severity due to potential memory leaks affecting Open vSwitch versions prior to 2.8.1.
How do I fix CVE-2017-14970?
To remediate CVE-2017-14970, upgrade Open vSwitch to version 2.8.1 or later.
What causes CVE-2017-14970?
CVE-2017-14970 is caused by multiple memory leaks during the parsing of malformed OpenFlow group mod messages.
Which versions of Open vSwitch are affected by CVE-2017-14970?
Open vSwitch versions prior to 2.8.1 are affected by CVE-2017-14970.
Is there a workaround for CVE-2017-14970?
There is no official workaround for CVE-2017-14970; upgrading to a fixed version is the recommended approach.

agent/references
agent/type
agent/remedy
agent/last-modified-date
agent/first-publish-date
agent/weakness
agent/severity
agent/author
agent/softwarecombine
agent/tags
agent/description
agent/event
collector/nvd-index
agent/software-canonical-lookup-request
vendor/openvswitch
canonical/open vswitch
version/open vswitch/2.8.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2017-14970?
CVE-2017-14970 has a medium severity due to potential memory leaks affecting Open vSwitch versions prior to 2.8.1.
How do I fix CVE-2017-14970?
To remediate CVE-2017-14970, upgrade Open vSwitch to version 2.8.1 or later.
What causes CVE-2017-14970?
CVE-2017-14970 is caused by multiple memory leaks during the parsing of malformed OpenFlow group mod messages.
Which versions of Open vSwitch are affected by CVE-2017-14970?
Open vSwitch versions prior to 2.8.1 are affected by CVE-2017-14970.
Is there a workaround for CVE-2017-14970?
There is no official workaround for CVE-2017-14970; upgrading to a fixed version is the recommended approach.