In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC     learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both     impedes network performance and allows users to possibly view the content of packets for instances     belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are     affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py. (CVE-2019-15753)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC
    learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both
    impedes network performance and allows users to possibly view the content of packets for instances
    belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are
    affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py. (CVE-2019-15753)

ID	Name	Product	Family	Severity
257850	Linux Distros Unpatched Vulnerability : CVE-2019-15753	Nessus	Misc.	critical
433785	SCA: security update for os-vif (GHSA-mcpw-cp35-p3h8)	Tenable Cloud Security	SCA Checks	critical
433785	SCA: security update for os-vif (GHSA-mcpw-cp35-p3h8)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2019-15753

critical

Tenable Plugins

critical

critical

critical