A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ovn | May 15, 2025 | Jan 23, 2025 |
| Suse | — | Upgrade ovn3-docUpgrade openvswitch3-develUpgrade ovnUpgrade libopenvswitch-3_5-0Upgrade python3-ovsUpgrade ovn3-hostUpgrade python3-openvswitchUpgrade ovn-develUpgrade ovn3-vtepUpgrade libopenvswitch-2_11-0Upgrade openvswitch3Upgrade openvswitch-testUpgrade libopenvswitch-3_1-0Upgrade ovn-centralUpgrade ovn3Upgrade openvswitch-vtepUpgrade libovn-25_03-0Upgrade ovn-vtepUpgrade libopenvswitch-2_14-0Upgrade ovn3-centralUpgrade openvswitch3-vtepUpgrade openvswitch-pkiUpgrade libovn-20_06-0Upgrade ovn3-dockerUpgrade openvswitch-docUpgrade openvswitch3-testUpgrade openvswitch3-pkiUpgrade ovn-hostUpgrade libovn-23_03-0Upgrade python3-ovs3Upgrade openvswitch-develUpgrade ovn-dockerUpgrade openvswitch3-docUpgrade openvswitchUpgrade openvswitch-ipsecUpgrade ovn3-develUpgrade ovn-docUpgrade openvswitch3-ipsec | Feb 20, 2025 | Jan 23, 2025 |
| Ubuntu | — | Upgrade ovn-centralUpgrade ovn-commonUpgrade ovn-dockerUpgrade ovn-hostUpgrade ovn-ic | Apr 1, 2025 | Jan 23, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub