CVE-2022-4337
First published: Thu Dec 29 2022(Updated: )
An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openvswitch Openvswitch | <2.13.10 | |
| Openvswitch Openvswitch | >=2.14.0<2.14.8 | |
| Openvswitch Openvswitch | >=2.15.0<2.15.7 | |
| Openvswitch Openvswitch | >=2.16.0<2.16.6 | |
| Openvswitch Openvswitch | >=2.17.0<2.17.5 | |
| Openvswitch Openvswitch | >=3.0.0<3.0.3 | |
| Debian Debian Linux | =11.0 | |
| debian/openvswitch | <=2.10.7+ds1-0+deb10u1 | 2.10.7+ds1-0+deb10u4 2.15.0+ds1-2+deb11u4 3.1.0-2 3.2.2~git20231029-2 |
| <2.13.10 | ||
| >=2.14.0<2.14.8 | ||
| >=2.15.0<2.15.7 | ||
| >=2.16.0<2.16.6 | ||
| >=2.17.0<2.17.5 | ||
| >=3.0.0<3.0.3 | ||
| =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/openvswitch/ovs/pull/405
- https://security-tracker.debian.org/tracker/CVE-2022-4337
- https://security-tracker.debian.org/tracker/CVE-2022-4338
- https://www.cve.org/CVERecord?id=CVE-2022-4337
- https://www.cve.org/CVERecord?id=CVE-2022-4338
- https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
- https://www.openwall.com/lists/oss-security/2022/12/20/2
- https://salsa.debian.org/openstack-team/third-party/openvswitch/-/commit/f8309d7c34e38d66d3af4e32c6142f770516d6d2
- https://bugs.debian.org/1027273
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1027273
- https://www.debian.org/security/2023/dsa-5319
- https://www.openwall.com/lists/oss-security/2022/12/21/4
- https://github.com/openvswitch/ovs/commit/be53a5c447c3ed77ef2d4e1e09ea63de576b90e8
- https://github.com/openvswitch/ovs/commit/7490f281f09a8455c48e19b0cf1b99ab758ee4f4
- https://security.gentoo.org/glsa/202311-16
Frequently Asked Questions
What is CVE-2022-4337?
CVE-2022-4337 is an out-of-bounds read vulnerability in Organization Specific TLV found in various versions of OpenvSwitch.
Which versions of OpenvSwitch are affected by CVE-2022-4337?
Versions up to and including 2.13.10, versions from 2.14.0 to 2.14.8, versions from 2.15.0 to 2.15.7, versions from 2.16.0 to 2.16.6, versions from 2.17.0 to 2.17.5, and versions from 3.0.0 to 3.0.3 of OpenvSwitch are affected by CVE-2022-4337.
What is the severity of CVE-2022-4337?
CVE-2022-4337 has a severity rating of 9.8 (critical).
How can I fix CVE-2022-4337 in OpenvSwitch?
To fix CVE-2022-4337 in OpenvSwitch, update to version 2.10.7+ds1-0+deb10u4, 2.15.0+ds1-2+deb11u4, 3.1.0-2, or 3.2.0-2 if using the Debian package.
Where can I find more information about CVE-2022-4337?
More information about CVE-2022-4337 can be found at the following references: [1](https://github.com/openvswitch/ovs/pull/405), [2](https://security-tracker.debian.org/tracker/CVE-2022-4337), [3](https://security-tracker.debian.org/tracker/CVE-2022-4338).
- collector/debian-bugs
- alias/CVE-2022-4337
- collector/nvd-index
- collector/security-tracker-debian
- agent/type
- agent/author
- agent/remedy
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/openvswitch
- canonical/openvswitch openvswitch
- version/openvswitch openvswitch/2.14.0
- version/openvswitch openvswitch/2.15.0
- version/openvswitch openvswitch/2.16.0
- version/openvswitch openvswitch/2.17.0
- version/openvswitch openvswitch/3.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- package-manager/debian