The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5640 advisory.

  - A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which     may result in a denial of service and invalid memory accesses. Triggering this issue requires that     hardware offloading via the netlink path is enabled. (CVE-2023-3966)

  - A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual     machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted     packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary     IP addresses. (CVE-2023-5366)

  - openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in     openvswitch-2.17.8/lib/util.c. (CVE-2024-22563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-5640 : openvswitch-common - security update

medium Nessus Plugin ID 192117

Version 1.0