CVE-2020-35498
First published: Thu Dec 17 2020(Updated: )
A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openvswitch | <=2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12+deb10u2<=2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12<=2.15.0~git20210104.def6eb1ea+dfsg1-4<=2.10.6+ds1-0+deb10u1 | |
| Openvswitch Openvswitch | >=2.5.0<2.5.12 | |
| Openvswitch Openvswitch | >=2.6.0<2.6.10 | |
| Openvswitch Openvswitch | >=2.7.0<2.7.13 | |
| Openvswitch Openvswitch | >=2.8.0<2.8.11 | |
| Openvswitch Openvswitch | >=2.9.0<2.9.9 | |
| Openvswitch Openvswitch | >=2.10.0<2.10.7 | |
| Openvswitch Openvswitch | >=2.11.0<2.11.6 | |
| Openvswitch Openvswitch | >=2.12.0<2.12.3 | |
| Openvswitch Openvswitch | >=2.13.0<2.13.3 | |
| Openvswitch Openvswitch | >=2.14.0<2.14.2 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Fedoraproject Fedora | =33 | |
| redhat/openvswitch2.11 | <0:2.11.3-86.el7fd | 0:2.11.3-86.el7fd |
| redhat/openvswitch2.13 | <0:2.13.0-81.el7fd | 0:2.13.0-81.el7fd |
| redhat/openvswitch | <0:2.9.9-1.el7fd | 0:2.9.9-1.el7fd |
| redhat/openvswitch2.13 | <0:2.13.0-79.5.el8fd | 0:2.13.0-79.5.el8fd |
| redhat/openvswitch2.11 | <0:2.11.3-83.el8fd | 0:2.11.3-83.el8fd |
| redhat/ovn2.11 | <0:2.11.1-57.el7fd | 0:2.11.1-57.el7fd |
| debian/openvswitch | 2.10.7+ds1-0+deb10u1 2.10.7+ds1-0+deb10u4 2.15.0+ds1-2+deb11u4 3.1.0-2 3.2.2~git20231029-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2020-35498
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35498
- https://www.openwall.com/lists/oss-security/2021/02/10/4
- https://salsa.debian.org/openstack-team/third-party/openvswitch/-/commit/e1cad68dfe3a3102c84bd59950ea43dad65653e8
- https://bugs.debian.org/982493
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982493
- https://bugzilla.redhat.com/show_bug.cgi?id=1908845
- https://www.debian.org/security/2021/dsa-4852
- https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/
- https://security.gentoo.org/glsa/202311-16
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1927492
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1927493
- https://github.com/openvswitch/ovs/commit/79349cbab0b2a755140eedb91833ad2760520a83
- https://github.com/openvswitch/ovs/commit/0625dc79aec73b966f206e55655a2816696246d0
- https://github.com/openvswitch/ovs/commit/59b588604b89e85b463984ba08a99badb4fcba15
- https://github.com/openvswitch/ovs/commit/3512fb512c76a1f08eba4005aa2eb69160d0840e
- https://github.com/openvswitch/ovs/commit/53c1b8b166f3dd217bc391d707885f789e9ecc49
- https://github.com/openvswitch/ovs/commit/abd7a457652e6734902720fe6a5dddb3fc0d1e3b
- https://github.com/openvswitch/ovs/commit/79cec1a736b91548ec882d840986a11affda1068
- https://github.com/openvswitch/ovs/commit/48ceca0446b1c2c2c03e7551048c5b19ed23cc97
- https://github.com/openvswitch/ovs/commit/35c280072c1c3ed58202745b7d27fbbd0736999b
- https://github.com/openvswitch/ovs/commit/ad0d22f6435b43ecfc30c0e877d490d36721f200
- https://github.com/openvswitch/ovs/commit/673c08eee8c8d4f2999ddd31524de7ff0f72b559
- https://github.com/openvswitch/ovs/commit/354e7d860e444fd1472541b0fdc3b8678aa74828
- https://access.redhat.com/errata/RHSA-2021:0497
- https://access.redhat.com/security/cve/cve-2020-35498
- https://access.redhat.com/errata/RHSA-2021:0837
- https://access.redhat.com/errata/RHSA-2021:0834
- https://access.redhat.com/errata/RHSA-2021:0835
- https://access.redhat.com/errata/RHSA-2021:1050
- https://access.redhat.com/errata/RHSA-2021:2077
- https://access.redhat.com/errata/RHSA-2021:2456
- https://www.cve.org/CVERecord?id=CVE-2020-35498 https://nvd.nist.gov/vuln/detail/CVE-2020-35498 https://www.openwall.com/lists/oss-security/2021/02/10/4
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID for this openvswitch vulnerability?
The vulnerability ID for this openvswitch vulnerability is CVE-2020-35498.
What is the severity of CVE-2020-35498?
The severity of CVE-2020-35498 is high (7.5).
What is the affected software for CVE-2020-35498?
The affected software for CVE-2020-35498 is openvswitch.
How can a malicious user exploit CVE-2020-35498?
A malicious user can exploit CVE-2020-35498 by sending a specially crafted packet to the openvswitch, causing a denial of service.
Is there a remedy for CVE-2020-35498?
Yes, there is a remedy for CVE-2020-35498. The recommended remedy is to update openvswitch to version 2.5.12 or higher.
- collector/redhat-cve
- collector/debian-bugs
- alias/CVE-2020-35498
- collector/nvd-index
- collector/security-tracker-debian
- collector/nvd-api
- agent/author
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/trending
- package-manager/redhat
- package-manager/debian
- vendor/openvswitch
- canonical/openvswitch openvswitch
- version/openvswitch openvswitch/2.5.0
- version/openvswitch openvswitch/2.6.0
- version/openvswitch openvswitch/2.7.0
- version/openvswitch openvswitch/2.8.0
- version/openvswitch openvswitch/2.9.0
- version/openvswitch openvswitch/2.10.0
- version/openvswitch openvswitch/2.11.0
- version/openvswitch openvswitch/2.12.0
- version/openvswitch openvswitch/2.13.0
- version/openvswitch openvswitch/2.14.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33