openvswitch (SUSE:Linux Enterprise Module for Package Hub 15 SP4) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Package Hub 15 SP4 package openvswitch, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2022-4337 — CVSS 9.8 (critical): An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
• CVE-2022-4338 — CVSS 9.8 (critical): An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
• CVE-2023-1668 — CVSS 8.2 (high): A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action…
• CVE-2023-5366 — CVSS 7.1 (high): A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This…
• CVE-2022-32166 — CVSS 6.1 (medium): In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function…
• CVE-2021-36980 — CVSS 5.5 (medium): Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and…