A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ovn | May 15, 2025 | Jan 23, 2025 |
| Suse | — | Upgrade openvswitch-ipsecUpgrade ovn3-develUpgrade openvswitchUpgrade openvswitch3-docUpgrade openvswitch3-testUpgrade ovn-hostUpgrade openvswitch3-pkiUpgrade libovn-23_03-0Upgrade openvswitch-vtepUpgrade openvswitch-docUpgrade openvswitch-develUpgrade libovn-20_06-0Upgrade ovn-dockerUpgrade ovn3-centralUpgrade ovn3-dockerUpgrade libopenvswitch-2_14-0Upgrade openvswitch-pkiUpgrade openvswitch3-vtepUpgrade libovn-25_03-0Upgrade python3-ovs3Upgrade ovn-vtepUpgrade openvswitch3-ipsecUpgrade ovn-docUpgrade ovn3-vtepUpgrade libopenvswitch-3_5-0Upgrade python3-ovsUpgrade openvswitch-testUpgrade ovn3-docUpgrade ovn-centralUpgrade libopenvswitch-3_1-0Upgrade ovn3Upgrade openvswitch3-develUpgrade python3-openvswitchUpgrade ovn3-hostUpgrade ovnUpgrade openvswitch3Upgrade ovn-develUpgrade libopenvswitch-2_11-0 | Feb 20, 2025 | Jan 23, 2025 |
| Ubuntu | — | Upgrade ovn-dockerUpgrade ovn-icUpgrade ovn-centralUpgrade ovn-hostUpgrade ovn-common | Apr 1, 2025 | Jan 23, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub